Cyber attack thaws French supermarket defences
 
A cyber attack that left refrigerators defrosting across hundreds of French supermarket stores, putting millions of euros worth of food at risk, has exposed a surprising vulnerability in retail infrastructure.  As major chains including Carrefour, Intermarché, Coopérative U and Netto working to identify refrigeration systems that could be susceptible to cyber attacks, we talk to Thomas Plank, CEO, Tributech about why digital threats can quickly translate into costly physical damage and operational disruption.

“The services that we all rely on are increasingly a prime target for cyber attacks and they cause widespread disruption.  While cybersecurity strategies typically focus on protecting customer data, payment systems and corporate networks, the attack demonstrates how overlooked operational technology (OT) can provide another route for cyber criminals to disrupt businesses, damage assets and undermine supply chains.”

“The freezers in around 500 French supermarkets did exactly what they were told, a command arrived (defrost, and keep defrosting) and the equipment executed it for six hours, at temperature up to 80°C.”

“Before any command touches a physical asset, two checks have to happen, right where it lands.  The first is to ask whether the command is genuine.  Did it come from an authorized origin, unaltered, not replayed, not injected by a compromised system along the way?  A network connection or a login on an intermediate server proves none of these points.  The command itself must carry the proof, and the asset must verify it.”

“The second check is whether the command is allowed.  Even a genuine command can be wrong; a stolen credential, a careless operator, a faulty AI writeback.  A freezer has physics and the defrost command lasts minutes, frozen setpoints, therefore, need to stay below zero.  Anything outside that envelope should either be refused or require a second approval.  If either check is failed, the command should never execute.”

“On Sunday night, neither of these checks existed where it mattered.  So, a few lines of instruction became millions of euros of food in the bin.”

“Zero trust in operational technology means not trusting the network, not trusting the server, but verifying every command at the asset, and checking it against policy, before it runs.”

“As more physical infrastructure becomes digitally connected, the French supermarket incident serves as a stark reminder that cybersecurity must extend beyond traditional IT systems to protect the technology keeping businesses operational.”

 ​