Cyberattack on supermarket fridges: Anssi points to “basic security defects”

The cyberattack against supermarket refrigerators in France in October was made possible because of “basic security defects,” the director of the national information systems security agency lamented this Wednesday, October 21, regretting that Anssi's recommendations were not respected by companies.

“I have seen various third-party analyzes circulating” on the attack, claiming that it exploited “vulnerabilities made public by different cybersecurity researchers over the previous two years,” Vincent Strubel explained during a senatorial hearing. “Our analysis today is that these are not the vulnerabilities that were exploited. These are basic security defects, starting with the direct exposure on the internet of refrigeration equipment and their administration without particular security, weak passwords, that kind of thing,” revealed the director general of the agency.

“Our recommendations are not respected”

“Since 2014, Anssi has published and updated a guide on securing industrial systems, the first recommendation of which is not to expose them directly on the internet. But, obviously, our recommendations are not systematically respected,” he lamented before the Foreign Affairs and Defense Committee of the Upper House. “Anssi does not currently have the means to force supermarkets to deploy refrigerators,” he said, recalling that it was then up to each of the stakeholders concerned to respect the recommendations and alerts issued by the agency.

A massive cyberattack targeted hundreds of supermarket refrigerators around October 12, during which the attackers took remote control of the refrigeration installations, raising the temperature and forcing distributors to throw away a large quantity of food.

Vincent Strubel also underlined that similar installations existed “in many other sectors, and in particular in the health sector”, “from research laboratories to pharmacies which store vaccines”. “We carried out extremely intense and very rapid and very effective work (...) with all health stakeholders to ensure that these fridges used (...) to store things that are sometimes dangerous, sometimes essential to the health of our fellow citizens, were well protected,” he added.