Hackers likely exploited simple flaw in supermarket cooling systems

Hackers probably exploited a simple vulnerability to access supermarket refrigeration systems in several European countries, including Denmark, DR reports.

DR News’ research suggests the control panels for refrigerated display cases were protected by a relatively simple access code that changed daily but could still be cracked, allowing access to the cooling systems.

“If you’re an attacker, the advantage of this kind of flaw is that the vulnerable system may be installed in many places. Once you work out how to exploit it in one place, you can do the same elsewhere,” said Jens Myrup Pedersen, a professor of computer technology.

Danish company Danfoss confirmed that some of its systems were affected. The company says it discovered the vulnerabilities some time ago with the help of what it called “friendly hackers” and has urged customers to replace or update the systems.

“Some have not managed to do that, and that is deeply regrettable, for us, for them and for their customers,” said Danfoss communications director Kasper Elbjørn. If systems need to be replaced entirely, customers must cover the cost, he said.

The perpetrators have not been identified. In Sweden, the attackers reportedly changed the temperature in some refrigerators and freezers to 50 degrees overnight, damaging food that had to be thrown away.

Pedersen said attacks on supermarket refrigeration systems fit a pattern of hackers seeking easy targets that attract attention. He added that organisations are generally not prepared enough for this type of attack and may underestimate how easy it is to exploit vulnerabilities that have not been fixed.