Supermarket fridge hacking attacks due to lack of basic cybersecurity measures, expert says

This is apropos. Investigators here in France are continuing the search for hackers who seized control of cooling units at hundreds of supermarkets in a cyber attack that's underlined the vulnerabilities of connected systems. The absence of a claim of responsibility has puzzled authorities. Typically, such groups tend to quickly seek to monetize their activities or claim credit for them for political ends. With the latest, Caitlin Brant. On Tuesday morning, restocking shelves was the priority for this supermarket in the Paris region. As for the products, it's hard to fully restock. That includes the whole butchers and poultry sections. The entire frozen food range has been thrown away. Every single aisle. On Monday, an unprecedented cyber attack targeted several hundred shops across France. Hackers took control of the temperature regulation systems in the fridges, raising temperatures to as high as 50 degrees Celsius. Supermarkets have suffered losses amounting to several tens of thousands of euros. We experienced a cyber attack on our software. Today we have a total loss of fresh and frozen items. We want to apologize to our customers. We never thought we'd see this in our rural setting of Lae. Terms of fresh items, we've had to throw it all away. It's an enormous loss of stock. So, who are the hackers behind this large-scale cyber attack? No data was stolen, nor was a ransom demanded. The motive does not appear to be financial, according to this expert. It is more likely to be a case of external interference. This is a test designed to gauge the response of government departments, businesses, and even public opinion. Or it will help ensure a more coordinated approach in the future for various industrial information systems that French people use daily. The Paris Public Prosecutor's Office has launched an investigation led by its cybercrime division to identify those responsible. Well, to discuss, we're joined by cybersecurity expert Marta Rebriska, founder of Egrecy, a company specialising in open source security. Marta, thanks so much for being with us on the program. You have years of experience in advising manufacturers about security, among other things. What do you think happened here? What systems and services were targeted, and why? There are certain things that we know already. One is that those units were connected to the internet. They were connected to the internet because the operators of those units wanted to do. The administration, remotely. Without having people on site. And the other thing that we know is that many of those units were really outdated, so they were running firmware that was years old. And that had known issues. Issues that were known and documented for years. That should have been fixed. Should have been updated, but they weren't. And how big of a security issue do you think this is? People are going to be worried about perhaps hackers breaking into their devices at home. Other businesses are surely going to be worried about something like this being replicated in the future. Just how significant was it, and what exactly can hackers do with our own internet-connected devices? Unfortunately, such kind of attack is possible against all the elements of the infrastructure, especially the connected ones. So, I'm thinking about energy, like the solar panels that people install and then control remotely. We have attacks basically every day on home routers that people have at home, so it's not something that isn't happening. That's some that's something that we actually have. Every single day, but this time. They touched something that the operators didn't expect absolutely to happen. And unfortunately. That could happen for all the types of installations. And could something like this potentially threaten food supplies if it was carried out at a larger scale? Unfortunately. It seems that those outdated controllers are pretty popular, so. It is possible to run such an attack. At a large scale, even the good news that there are methods. To, at least, block the problem temporarily. They are pretty easy to do. The French cybersecurity agency has released an update advisory today. A kind of a guidebook. Saying what to do if they need to run such devices that they cannot replace them. So they are methods, but those operators need to have time, skills, and people to actually do that protection work. And broadly speaking, you mentioned some of the things that people can do to protect themselves. What can we as consumers actually do to better protect our information and our phones? So first, if we have such connected devices. Start from thinking if your device really needs to be available on the internet. If it needs to be for some reasons, check. If it's completely up to date, if there are any updates, especially security updates, to download and install, and do that. Then, if there is remote access. Use. Complicated, secure passwords, and if possible. Two-factor authentication to have a password as something else to allow. Allow the access, but really the most important thing for such devices is to make sure they are running up to date. And making sure that you actually run that update process for your phone applications, for your home automation, home routers, basically every device that you own. And Marta, do incidents like this also raise questions about the role of authorities in protecting essential services and also the infrastructure that we're all using every day? Absolutely, and we have a running topic here in France. There is the Nice Two directive. That is still not. Translated into the French law, that is a European directive about cybersecurity of critical infrastructure. And we also have a second regulation that is coming into place soon, called Cyber Resilience Act. That will be completely in place in December 27, and that is bringing requirements. For vendors of basically every piece of software or hardware, for example, to deliver updates, security updates of the products free of charge for the users. Because who is ultimately to blame when something like this happens? Supermarkets have lost so much money because of this incident. Are technology providers responsible, or should they be responsible for making sure that their products actually remain secure, or is this up to individual businesses and individual consumers? That's complicated question. In this case, the vendor. Will provide update. Provide the instruction to the users what they should do, but they cannot force the users to actually. Schedule maintenance to install updates. To actually look if there are some updates to install. Or to follow to use the user manual to configure the devices securely, so the vendor can do things. They can make the secure configuration easy. And enabled by default, but if the user is not. Updating the software, it's not following the best practices. Then it's complicated to protect such a system. Do we need to see tougher or stricter cybersecurity requirements then imposed on companies, or is it just simply, as you say, a matter of these individual retailers following the rules and regulations that are already in place? I think it's both. In this case, the operators of those shops. They just didn't imagine that something like that can happen, right? And there are many other places when people just do not imagine that they can be attacked. I work typically with small companies. And many of, in this case, device vendors, they start with telling me, we are too small to be attacked. As you can see in this case. A local supermarket. It's not too small to be attacked. And we should become all aware that. And do you think that incidents like this, you know, they might prompt these companies, these smaller retailers that you are talking about, to look again at their security and when it comes to these measures that they should be implementing in order to protect themselves, but also to protect consumers. I hope so. I work with vendors to to do actually that, to make them understand that. The small measures that they can make every day, like. Updating the software, like making sure that they use longer passwords. That can prevent them from. Throwing away tons of food and losing thousands, or even hundreds of thousands of euros. Cybersecurity expert Marta Ribrisca, thank you so much for being with us on the program this evening. We'll have to leave it there for now.