Hackers hijacked supermarket refrigerators and freezers in Europe on Monday and sabotaged the machines, the latest salvo in a wave of mysterious cyberattacks that also has targeted commissaries on U.S. military bases.
The attacks in Belgium, Sweden, Ireland and Estonia match those that the Defense Department is investigating after widespread freezer outages hit several domestic military bases in August and again in October.
One military official told Nextgov/FCW that a freezer at Fort Huachuca, Arizona, was set to defrost mode, causing all its food to be wasted.
People were interested in these podcasts
A similar attack hit France last month, when hackers sent temperatures soaring in hundreds of supermarkets and independent stores.
Nikita Shah, a senior fellow at the Center for Strategic and International Studies who specializes in cyberthreats and cybersecurity, said the attacks in the U.S. and Europe had “some very similar” signatures.
“Finding out who’s behind these things is a very complex technical process, and it can take months,” Ms. Shah told The Washington Times. She described the attacks as waves, citing the similar attacks against U.S. military bases, against France in mid-October and now the rest of Europe.
As cyberattacks have spread, concerns about sabotage have grown. Supermarkets in at least seven countries are reporting malfunctioning refrigerators and freezers.
Christophe Hansen, the European Union’s food and agriculture commissioner, warned that it appears to be a “deliberate attempt to disrupt our food supply chain.”
“Some of this has a political tinge to it,” Ms. Shah said. “A Russia-linked actor doing this to kind of send a psychological message because the thing they’re really doing is information warfare.”
Ms. Shah pointed out that many of the countries that have experienced cyberattacks are also supporters of Ukraine and may have participated in the recent U.S. funding of a major Patriot missile purchase for Ukraine.
In Belgium, the government determined that the freezer attacks constituted a national security incident, prompting its federal intelligence and security services to step in as part of the investigation.
Multiple European news outlets have reported that some supermarkets are struggling to respond to the attack, and some are unable to adjust the temperature settings on their equipment.
The internet-connected appliances were relatively unprotected, many of the shop owners said. The Associated Press has reported that the cyberattacks appear to target older systems.
“It sounds like it was some pretty basic technical vulnerabilities,” Ms. Shah said. “It just kind of speaks to the age-old problem that we have in cybersecurity of very important or critical systems still not having the basic measures in place.”
The Pentagon’s Cyber Command and law enforcement agencies within the department are investigating the freezer outages at U.S. military bases in August and October. It was unclear whether the same actors attacked both the freezers on U.S. military bases and those in European grocery stores.
Investigations into the cyberattacks at European supermarkets have found that critical systems were highly exposed and vulnerable to cyberthreats that had not previously been exploited.
Ms. Shah said many of the attacks appeared to be against equipment where “basic software vulnerabilities hadn’t been patched over time and also had very weak security measures in place.” She said those weak measures included “guessable passwords or weak authentication practices.”
Attacks on hardware systems that control industrial devices and infrastructure — known as operational technology — have historically required specialized knowledge, as hardware coding was specific to each device and use case.
An increase in operational technology attacks is also raising concerns that election machines and other election security devices in the U.S. could be at risk.
Earlier this year, suspected Iranian hackers targeted dozens of water utilities in the U.S., locking administrators out of their systems and forcing shutdowns. It is unclear whether the outages are directly connected, but those attacks fell into a similar category.
“It seems like signaling,” Ms. Shah said. “A lot of this kind of sabotage has the intent to send some kind of message.”
Recent cyberattacks in the days leading up to the U.S. midterm elections Tuesday align with warnings issued this year by the Cybersecurity and Infrastructure Security Agency that election season would bring more attacks.
The FBI and CISA said in a public service announcement last month that hackers and adversaries now leverage artificial intelligence to make their work much more effective, whether they are attempting cyberattacks on freezers or more advanced attacks on election officials and systems.
“It’s like a cyber-enabled information operation,” Ms. Shah said. “There’s always some kind of political angle to it. Tomorrow is a big day in the U.S.”
A report published in July by CISA found that assessments “repeatedly show that the IT networks operated by [state, local, tribal and territorial] election offices lack cybersecurity hygiene.”
In their mid-October public service announcement, the FBI and CISA warned that “cyber threat actors” would target election officials. They said AI chatbots and coding platforms now make bad actors exceptionally dangerous.
AI has allowed hackers to start using “convincing deepfake video and audio recordings” and, using these deepfakes, “to create new identities, steal the identities of real people, create realistic facsimiles of daily life and communication” to aid their attacks, a risk for election officials, according to the FBI and CISA.
The public service announcement said hackers would seek to “steal user data, including login credentials and sensitive information” from election officials, candidates and political organizations to access voter registration information and other sensitive lists.
“With a lot of this, what the hackers are trying to do is demonstrate that reach into a homeland,” Ms. Shah said. “Just to show that ability to undermine the state in that particular country, to show ‘Look, they’re not as capable of protecting you as you thought.’”
Contact the author
Please read our comment policy before commenting.