Supermarkets: Why refrigerated shelves are easy to hack

German retailers are reacting calmly to the increasing hacker attacks on refrigerated shelves in individual branches. “No comment,” said supermarket chains that were not affected by the attacks. “Our refrigerated shelves are running smoothly and the supply of fresh food for daily shopping is fully guaranteed,” writes a spokesman for Kaufland stores.

But the danger is real because the security vulnerabilities in the control systems of such plants are so obvious. “In general, such control systems are widely installed and many of them can also be accessed via the Internet,” explains Mirko Ross from the cybersecurity company Asvin. There is a reason for this accessibility: maintenance can be carried out remotely - which means there is no need for a technician to be on site.

Accessible via the Internet

This makes it easy for hackers. “Many devices are so old that there are no longer any security updates for them,” says Dennis-Kenji Kipker from the Cyberintelligence Institute in Frankfurt. "We don't yet know whether the perpetrators were specifically looking for supermarkets or simply came across open devices."

The perpetrators also benefit from the decentralized structure of retail. For example, the Edeka retail chain refers to its cooperative structure with “around 3,200 self-employed merchants,” as the Edeka press team says. The consequence: "Therefore there are no uniform cooling systems, but rather they differ regionally and locally." There are therefore no uniform security systems. Every market is on its own.

Nevertheless, the trade association is not very alarmed, pointing to "individual cases" without significant damage.

“After the first wave of cyber attacks on the cooling systems of French supermarket chains in October, the technology in German markets was checked numerous times,” writes the Federal Association of the German Food Trade in response to a request from the ARD financial editorial team. In addition, “digital and physical resilience is an ongoing task in German retail.”

But security experts point to the millions in damage that have already been inflicted on French retail. “Refrigerated counters across the country were successfully attacked and refrigerated goods worth several million euros were destroyed,” explains Mirko Ross from the cybersecurity company Asvin. "The problem: The affected thermostats are installed worldwide."

The consequences are obvious. There is an urgent need for action. “The most important thing is to take the controls off the open Internet and only allow remote access via a secure connection,” advises Dennis-Kenji Kipker. "Devices that no longer receive updates must be replaced and until then they should run in isolation."

Secure connections must therefore be created in order to continue to enable remote maintenance. Until that happens, there will continue to be a risk of further cyber attacks. The phenomenon could spread because the affected control systems are installed worldwide.

In the medium term, the cyber attacks on food markets could prove to be a test. “I expect further attacks,” said Kipker. “It is quite possible that we will next see cyber attacks on similarly poorly secured systems in cold storage, hospitals or building technology.” Wind power and solar systems could also be affected.

And: The attacks don't stop at living rooms. Mirko Ross reports that 1.3 million television sets have already been hacked worldwide. “So these cyberattack impacts are getting closer and closer.”