Grocery store attack exposes known weaknesses in connected systems

Refrigeration and freezer systems at several grocery stores in Sweden were disrupted in what appeared to be an IT attack, SVT reports. The National Cybersecurity Centre and other experts say the risks were already known and urge businesses in other sectors to review their security.

Systems at ICA and Coop stores had been manipulated by Monday morning. Sweden’s national IT incident response unit, part of the National Cybersecurity Centre, is involved. The centre’s head, John Billow, said it was providing support and working to establish what had happened, but could not discuss specific cases or how many organisations it was in contact with.

Billow said internet-connected operational technology, often used in industry, has frequently been poorly protected. He urged organisations to consider whether such systems need an internet connection and to take security measures if they do.

After a similar incident affected hundreds of French grocery stores in October, several devices were found to have very simple passwords and no multifactor authentication, Billow said. He described stronger passwords and properly configured firewalls as relatively straightforward measures.

The person or group behind the Swedish incident is unknown. Fredrik Blix, a cybersecurity researcher at Stockholm University, said the attacker most likely targeted suppliers’ systems. Information about poorly secured systems and likely default passwords is also available online, he said.

Blix urged laboratories, pharmaceutical refrigerators and other businesses using similar systems to review their security immediately. The National Cybersecurity Centre has recently surveyed exposed devices in Sweden, including in the energy sector, Billow said.