How third-party systems leave supermarkets vulnerable to cyber attacks

French authorities are investigating after a "large-scale" cyber attack targeted supermarkets and resulted in millions of euros of food wastage. 

It raises questions about whether Australian supermarkets could be vulnerable to similar attacks. 

What happened to the French supermarkets?

Hackers turned up the temperatures on fridges and freezers in hundreds of stores, spoiling food that had to be discarded.

Les Mousquetaires, owner of retailer Intermarche, said fridges at about 150 of its stores were heated up to 50 degrees Celsius for six hours overnight. 

Many major supermarkets manage their fridges and freezers by control panels that can be accessed over the internet, allowing maintenance companies to change settings without having to physically enter a store. 

"Attackers do not necessarily need to hack individual fridges," University of Queensland's Cyber Research Centre director Ryan Ko says.

"More commonly, they gain access through compromised credentials, vulnerable remote access services, third-party suppliers, or inadequately secured operational technology management platforms.

"Once inside, they can potentially change temperature set points across many locations at once."

'Outdated firmware'

France's National Cybersecurity Agency (ANSSI) identified a vulnerability in software supplied by Danish company Danfoss, a source close to French Prime Minister Sebastien Lecornu told Reuters.

Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems".

The company said the affected units "were running outdated firmware".

Danfoss also said it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions".

In August, cybersecurity firm Claroty's Team82 published research detailing vulnerabilities in the Danfoss AK-SM 800A controller. 

That report detailed software updates released by Danfoss that addressed the vulnerabilities that may have allowed attackers to bypass authentication controls and execute code on compromised devices.

How did it happen?

We don't have the confirmed details of that yet, so we can only speculate. 

Macquarie University cyber security lecturer Jennifer Williams says hackers could have taken advantage of an outdated software system.

"It could be that there was a vulnerability that was already known with the software, but it wasn't patched because they didn't update it," Dr Williams says.

"The other possibility is there's something called a zero-day vulnerability, which is there's been zero days that that vulnerability has been made public.

"That means that no-one knows about it. 

"Even the software providers might not be aware and able to control some of those security vulnerabilities."

We'll find out more about exactly how this happened once the ANSSI investigation wraps up. 

How widespread was the attack?

Hundreds of stores were affected. 

At least 300 shops of Intermarche or its Netto brand were targeted, along with over 100 Cooperative U outlets as well as several E Leclerc stores, according to Agence France-Presse.

Reuters reported that 80 Carrefour Market stores and 5 per cent of Monoprix stores were also affected.

There was no immediate estimate of industry-wide losses.

However, Intermarché chief executive Thierry Cotillard told local media the attack would result in "tens of millions of euros nationwide".

Could the same thing happen here?

It's possible, especially if our supermarkets are using similar systems, Professor Ko says.

"A likely scenario would involve attackers compromising a retailer's corporate network or a centralised refrigeration management platform, then moving into the operational systems that control refrigeration equipment," he says. 

"The incident might initially appear as an equipment fault, but could quickly escalate into food spoilage, store closures, lost inventory, supply chain disruption, and reputational damage. 

But Dr Williams says it's likely Australian supermarkets are on alert in case of "copycat" attacks.

"They're aware that this is now an exploit [and] they need to do something about it," she says. 

"It's a little bit of cat and mouse in the sense that the criminals might be out there trying to exploit it but, at the same time, the industry is trying to prevent that from happening."

Which supermarkets could be targeted?

"Places like Woolworths and Coles and Aldi … they're very centralised," Dr Williams says. 

"They might be slightly more vulnerable to that because they're more likely to have those centralised systems."

However, independent stores like IGA could be less vulnerable to the attacks if they're not using a wide-ranging centralised system like the supermarkets. 

Professor Ko says Coles or Woolworths would be more attractive targets for cyber criminals because of the wider scope of an attack.

"However, being a target is not the same as being vulnerable," he says.

"Larger organisations typically invest significantly in cyber security, monitoring, and incident response capabilities. 

"Smaller retailers and independent operators may have fewer resources dedicated to cyber security and could therefore be more vulnerable to compromise. 

"In practice, every organisation connected to digital systems is potentially exposed, regardless of size."

The ABC has contacted Woolworths, Coles, Aldi and IGA for comment. 

The future of cyber attacks?

Rahat Masood, a senior lecturer in computer science at the University of New South Wales, says the French incident demonstrates a shift in the cybersecurity threat landscape. 

"Traditionally, when we think about cyber attacks, we think about stolen personal information, ransomware or disrupted websites," Dr Masood says. 

"However, our physical infrastructure is becoming increasingly dependent on interconnected digital technologies. 

"Supermarkets, hospitals, manufacturing facilities, transport systems and even commercial buildings now rely on software and internet-connected devices to manage essential operations."

While this technology can make things more efficient, Dr Masood says they offer new opportunities for cybercriminals, especially when dealing with aging systems. 

"Operational technology systems are often designed to operate for many years," she says. 

"Some were developed when cybersecurity was not a major design consideration. 

"As a result, organisations may continue using equipment with outdated software, limited security protections or vulnerabilities that are difficult to patch."

It comes at a time when artificial intelligence (AI) is advancing, giving cyber criminals more tools. 

"AI models are very aggressive," Dr Masood says.

"If you instruct them to find the vulnerability in that system, they can go by any means to find that vulnerability. 

"It's not just a human mind who actually gets tired … they don't get tired."

ABC with Wires