In mid-October, 700 supermarkets across France were targeted by an attack that upped the temperature on freezers as high as 50 °C, leading to a loss of tens of millions of euros in spoiled food, damaged equipment and fires.
A second wave on 2 November hit stores in Belgium, the Netherlands, Ireland, Sweden, Estonia, Luxembourg and Portugal. One Intermarché store in Haguenau, France, lost its entire frozen stock, worth an estimated €50,000, according to French media.
As yet, no group or individual has claimed the attacks and, while there has been some finger-pointing, Belgian authorities have said the attackers may never be identified.
For the leaders who manage infrastructure and approve budgets, two questions matter most: how were hackers able to access and control the equipment, and who pays to prevent it next time?
What caused the supermarket attacks?
The attacked controllers came from several models that had been discontinued years earlier, made by three manufacturers. Thousands of these discontinued but in-use controllers could be reached directly from the internet. On the day of the first attack, around 3,000 of these were visible online, most of them in France. In the Netherlands, Danfoss - one of the manufacturers of these controllers - said the affected systems "were not on a secure network and still used default passwords".
This means that no sophisticated hacking was needed. An old device that is reachable from the internet and still uses its factory password is open to anyone who looks for it.
The root-cause of these attacks, therefore, is ownership. In a typical store, facilities owns the refrigeration, IT owns the network and a service contractor holds the remote access. Each signs off at installation. After go-live, nobody has a budget line to replace the controller when the manufacturer stops supporting it or to close the remote access once it is no longer needed. It disappears into a black hole, leaving risk and exposure.
Why does this risk land on the P&L?
Despite supermarket refrigeration systems running for about 15 years, the software in its controller is kept secure for only part of that time.
The gap is a known cost that can be planned years ahead. Yet, in most retail budgets it is not planned because security was approved once, as part of the installation project, and then treated as complete.
Three things make that cost land on the store operator:
- Insurance may not pay. Cyber policies often exclude physical damage such as spoiled stock. That usually needs separate cover, and Intermarché initially said its insurance did not cover the incident.
- Regulation will not fix equipment already installed. The EU Cyber Resilience Act requires manufacturers to support their products for at least five years, but only for products sold from December 2027 onwards (Article 69). The NIS2 directive, which makes management accountable for cybersecurity, does not cover food retail.
- The manufacturer has moved on. A discontinued controller does not get security fixes.
The risk stays with the operator. Security for connected equipment is a running cost for as long as the equipment runs. It belongs in the operating budget next to maintenance and energy, not only in the capital budget of the installation project.
What a better design changes
Nothing installed today repairs an old controller. A better design changes whether that controller needs to be reachable from outside at all, and how much it costs to keep secure.
In this design, every device in a store sends its data to one central messaging system, called a broker, and receives instructions only through it. Monitoring, central operations and the service contractor all work through that single point instead of logging into each device. For the budget holder, three things follow:
- One door instead of hundreds. Securing one connection per store is cheaper and easier to audit than securing every device's own login.
- Every action has a name on it. Each person, system and contractor has its own access, limited to what it needs, and every instruction sent to equipment can be traced.
- Contractor access follows the contract. When a service contract ends, access is removed in one place on the same day.
The instructions sent to equipment need the most protection. Adjusting a freezer is what a service contractor is paid to do, and it is also what the attackers did.
HiveMQ provides this kind of broker. Every HiveMQ deployment includes our Enterprise Security Extension, which provides the identity and access controls described above. Since 2015 we have published the MQTT Security Fundamentals, a series on how to secure MQTT systems, and our teams help customers put these controls in place during implementation. The tooling and the expertise are available on day one. What each project still needs is the decision to fund the setup and the ownership that follows.
Paxton, which makes access control systems for buildings, uses this pattern. Its products are installed in over 30,000 buildings a year across 60 countries, in industries that include retail. Paxton runs tens of thousands of simultaneous connections on HiveMQ and chose the Enterprise Security Extension because, in its words, it "needed more than the standard TLS security features". Building access and refrigeration are different equipment with the same risk: physical devices across many sites, controlled centrally, where a wrong instruction has physical consequences.
Catching what you cannot prevent
A freezer should never be set to +50 °C, whoever sends the instruction. When all instructions pass through one point, a simple rule can block the ones no freezer should ever receive and alert a person. HiveMQ can enforce rules like this today. The next step, which we are building toward, is software agents that know the normal range for each type of equipment and ask a person to approve anything unusual before it reaches the store.
None of this replaces keeping equipment up to date. It limits the damage when that fails.
Three questions before the next budget sign-off
For finance, operations and board members who approve spending on connected equipment:
- Who owns each connected device's security after go-live, and for how many years? If the answer is the installer, ownership ends when the project ends.
- When does vendor support end, compared with the planned replacement date of the asset? The difference is a cost that belongs in today's plan.
- If someone took control of our connected equipment tonight, what would it cost, and who would pay: us, our insurer or our service provider? If the answer is "us", the cost of preventing it belongs in the operating budget.
The supermarket attacks used no advanced technique. They found devices that nobody was paid to look after. Fixing that is a budget decision.
