It’s time for retailers and CPG companies to check their passwords – the days of 12345 and password1 are over.
A series of cyber attacks in Europe targeting the food supply in recent weeks have prompted a new warning from the Cybersecurity and Infrastructure Security Agency (CISA) calling on retailers to be vigilant monitoring for similar attacks in the US.
CISA, the FBI and the departments of Health and Human Services, Agriculture and Transportation urged stakeholders across the food supply chain, as well as those in healthcare, public health, chemical, agriculture and transportation systems sectors to defend against cyber attacks with “strong authentication, keeping systems updated, identifying any systems that are accessible from the internet, removing unnecessary remote access and securing any necessary remote access.”
Retailers and CPG companies that rely on refrigeration or cold-chain monitoring systems could be impacted if the attacks spread to the US, according to officials.
European supermarkets targeted
The first round of attacks took place on Oct. 11 and 12, when hackers took control of refrigeration systems at hundreds of French supermarkets, raising temperatures as high as 120°F and spoiling millions of euros worth of food.
On Nov. 9, French Foreign Minister Jean-Noel Barrot publicly accused Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran of carrying out the cyber attack, calling the attack “unprecedented in both its scale and its level of aggression,” according to Agence France-Presse.
The second round of attacks hit on Nov. 2 and 3, impacting more than 100 grocery retailers in seven European countries – Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. Hackers appeared to have used the same method used against French retailers, according to BBC.
“In close collaboration with our government, industry and international partners, CISA is actively tracking this threat activity,” said CISA Acting Executive Assistant Director for Cybersecurity Chris Butera. “Every organization that depends on refrigeration and monitoring systems should assume it could be a target. We urge you to review the joint fact sheet and take action now to close known security gaps.”
US refrigeration outages under investigation
Attacks have likely already taken place in the US on a small scale. More than half a dozen US military commissaries experienced outages in late August.
The outages took place at bases in California, New Mexico, Rhode Island, Arkansas, Wyoming, Georgia and Arizona, according to Army Times.
In addition to retailers, US authorities said attacks could also target cold storage facilities.
“The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards,” CISA said.
Bad actors could exploit authentication bypass, arbitrary code injection and weak configurations, CISA said. Put simply, hackers take control of the system by bypassing regular login and tricking the device into following their instructions. Equipment setup with “weak configurations” makes unauthorized access easier.
How companies can protect refrigeration systems
CISA and the National Institute of Standards and Technology (NIST) recommended organizations protect themselves from cyber attacks by:
- Eliminating public internet exposure, particularly controller panels. If remote access is necessary, use a firewall or edge device that is updated to protect against the latest security vulnerabilities.
- Creating a virtual local area network (VLAN) to separate operational technology (OT) from business networks.
- Updating and strengthening passwords and implementing strong password policies.
- Keeping device firmware up to date.
- Limiting access to devices and IP addresses authorized to make changes.
- Keeping reliable system backups.
- Enabling logging and regularly reviewing logs for unexpected activity.
- Identifying, retiring and replacing legacy devices that the vendor no longer supports.
FBI on alert
The FBI warned that US refrigeration systems could face similar threats.
“The FBI urges every organization that relies on these systems to review our guidance, implement the recommended mitigations, and report any suspicious activity to the FBI,” said FBI Cyber Branch Operations Director Brett Leatherman.
FutureShop is a twice-monthly column by Timothy Inklebarger exploring the forces shaping grocery retail. The views expressed are the author’s own and do not necessarily reflect those of this publication.
