Cyber-attacks on supermarkets: Germany affected, millions in damages threatened
Following attacks in France, Sweden and Belgium, German supermarkets have become targets of hacker attacks on cooling systems. Potential damages could run into millions.
Hacker attacks on cooling systems in German supermarkets
At the beginning of this week, German supermarkets reported several cases of cyber-attacks on their cooling systems. According to morgenpost.de, hackers had taken control of refrigerators and freezers around midnight and set them to defrost mode. The approach corresponded to earlier attacks in France, Sweden and Belgium.
The attacks resulted in the destruction of large quantities of foodstuffs. Yoghurts, milk drinks, frozen pizzas, chicken nuggets and ice cream had to be disposed of. In France, hundreds of branches were affected three weeks earlier, with cooling units in some cases heating up to 50 degrees. In Germany, according to current knowledge, only a manageable number of stores were affected.
Weaknesses in older technology
The attacks targeted cooling systems from Danish manufacturer Danfoss. According to the company, older technology was affected that had reached the end of its lifespan and no longer received software or security updates. The vulnerabilities had been known for months. Security researchers pointed out that many of the affected systems were simply accessible from the internet.
Christopher Kunz, security expert at Heise Online, warned as early as October of similar attacks on Germany. "A comparable attack on German supermarkets is possible," he told the Morgenpost. The typical behaviour of many companies and consumers was the problem: "Connected devices are primarily treated as a long-lasting piece of 'dumb technology' that you buy once and continue to operate."
Differing vulnerability of retail chains
The German supermarket landscape is more decentralised than the French one. An insider who operates several large branches explained to the editorial team that in cooperatively organised chains such as Edeka and Rewe, stores are in the hands of individual independent retailers. "They are my refrigerated shelves, I bought and installed them, I have a specialist company for that, and there is no central control at all," the operator said. From a purely technical standpoint, a large-scale failure like the one in France would therefore not be possible.
At Lidl and Aldi, the situation could be different, as they are centrally managed. "Such a scenario would be more realistic there," the insider suggested. Both company groups declined to comment when asked about possible risks.
Rewe stated that no comparable incidents were known at its own stores. The company continuously monitored the situation but would not comment on specific technical protective measures for security reasons.
High potential for damages
Should German stores be affected on a large scale by such an attack, the damage would likely run into millions. The value of goods in refrigerated and frozen products in an average supermarket is between €20,000 and €50,000 — depending on the size of the sales area and how full the shelves and storage areas are at the time of an attack.
The market operator emphasises the high security standards of his association: "For every process we need a new password, a second factor, a token generator." The company is also prepared for technical disruptions — if internet connections fail, battery-powered card readers with their own SIM card can process payments. An attacker would have to disrupt the mobile network connection for that.
The Federal Association of German Food Retail stated that crisis preparedness is very important for retail companies. Companies were intensively addressing how they could maintain business operations and were already investing extensively in digital and physical resilience.
Consumers would quickly notice cyber-attacks on supermarkets, said Kunz of Heise Online. Just-in-time logistics for foodstuffs meant that disruptions quickly became apparent.
Source: Die Zeit Kriminalität