“It could be a supply chain sabotage operation”… Refrigerator hacking repeats with unknown mastermind

In recent weeks, 'refrigerator hacking attacks' have taken place against supermarkets and blood banks across Europe, but European countries are on edge as the mastermind has not been revealed.

There are observations that 'state actors' such as Russia and China are suspected to be behind this, but there is currently no solid evidence.

According to the French Ministry of Health on the 4th (local time), several local blood centers in France suffered cyber attacks between the night of the 1st and the early morning of the 2nd.

Hackers are known to have manipulated the standard setting so that the refrigeration facility temperature, which should have been -30 degrees, could rise up to 110 degrees.

The Ministry of Health said the situation is now under control and there has been no damage to blood products stored at these facilities.

According to reports from AP, Reuters, and AFP, cyberattacks on supermarket refrigerators have been carried out in at least 13 European countries in recent days, including Belgium, Estonia, Finland, Greece, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, Germany, Romania, and the United Kingdom.

Because of this, some retailers had to discard food because refrigeration temperatures were not properly maintained.

The Italian government held an emergency meeting with intelligence agency heads on the 3rd to discuss responses to this cyber attack.

Three weeks ago, a similar cyberattack against refrigerators occurred on a large scale in France, causing hundreds of supermarkets to throw away food.

Also, in early August, refrigerator malfunctions occurred for unknown reasons at at least six military bases in the United States, and the U.S. Department of Defense is investigating the possibility of hacking.

According to what has been revealed so far, the hacking of French supermarkets appears to have occurred on old devices that have not yet been patched despite known vulnerabilities, or that administrators took advantage of lax security policies such as not changing passwords.

According to the Associated Press, French cybersecurity investigators identified outdated remote control modules manufactured by Danfoss of Denmark and Copeland of the United States as the problem.

Most of these products were discontinued and no security or software updates were provided.

British cyber minister Liz Lloyd pointed out that the cyberattack targeting French supermarkets was the result of a known vulnerability being exploited.

“This clearly shows that failure to adhere to basic cybersecurity practices, such as the use of weak passwords, continues to put organizations at risk,” he added.

Richard Horne, director of the UK's National Cyber ​​Security Center (NCSC), told reporters that the French supermarket's refrigerators were "connected directly to the internet using default passwords" and that the attack appears to have exploited a known security vulnerability.

He told the BBC that the problem had affected "the entire food supply chain" and that staff had been working overnight to warn businesses at risk.

Christoph Hansen, the European Union's food and agriculture commissioner, described the cyberattack on refrigerators on the 2nd as "a deliberate attempt to disrupt our food supply chain."

EU spokesman Thomas Renier said on the 3rd that EU institutions are consulting with member states to come up with a joint response plan, and said, "These are not individual, unrelated incidents. Of course, we must be prepared and have the capacity to jointly respond and recover from such cyber incidents."

However, Spokesperson Rainier also refused to point out any suspicious forces behind the incident.

Claims were also raised online that a hacking group linked to Russia claimed to be behind the incident.

According to a post posted on the 4th by a cyber threat researcher active under the username 'CyberKnow20' on social media

This post has now been deleted.

However, the researcher added that it is doubtful whether they actually hacked, and that their claims are not credible.

Although no evidence has been revealed so far to point out who committed this attack, suspicions are being raised that 'state actors' such as Russia or China may be behind it.

According to the British daily Guardian, Rafe Pilling, senior director of threat intelligence at cyber security company Sophos, said, "I think there are two most likely attack actor scenarios. One is if they are a nation-state trying to send a message or show off their capabilities, and the other is a 'lone wolf' type of hacker who carries out these attacks for personal reasons."

The Guardian said, “It seems most likely to be the work of a state-linked force,” and pointed out that the public may experience psychological shock when they see groceries disappearing from supermarket shelves.

At the same time, he analyzed, "North Korea is being pointed out as the mastermind behind the hacking incident of the cryptocurrency exchange Binance that occurred last week, but in this case, there is a possibility that hackers linked to Russia or China may have been involved."

The Guardian pointed out, “Western intelligence chiefs say Moscow is carrying out various forms of sabotage in Europe, and that these activities are likely to intensify in the coming months.”

At the same time, he explained, "This hacking method is relatively simple, making it more difficult to identify the culprit. Since not even malicious code was used, there are no traces of attack tools left at the scene of the crime."

Feeling likened it to “putting on rubber gloves and touching a switch.”

However, some believe that the hacking method is amateurish and that the possibility of intervention by 'state actors' is not high.

Dan Chimpean, director of Romania's National Cybersecurity Service (DNSC), told AFP: "No other infrastructure (in Romania) was damaged. It appears to be somewhat amateurish. We have no doubts at all that a state-level actor may have been involved."