Supermarket cyberattacks raise concerns about smart home device security

Retailers Ahold Delhaize, Carrefour, and Colruyt reported an IT incident on Monday that affected refrigerators and freezers in stores across Belgium, Estonia, and Luxembourg, leading to temperature fluctuations and potential food spoilage. Swedish grocers ICA and Coop, along with an Ikea store in Belgium, also experienced similar disruptions, with one store explicitly attributing the issue to a cyberattack.

This incident follows a previous attack in France last October, where police reported hackers gained control of cooling units in hundreds of supermarkets, causing temperatures to rise as high as 50C, resulting in fires and food losses.

The evolution of refrigerators from simple appliances to internet-connected devices has introduced new security risks. While remote monitoring and control offer convenience, they also create potential vulnerabilities for cyberattacks.

In 2015, researchers demonstrated at a hacking conference in Las Vegas how a Samsung smart refrigerator could be compromised. Devices connected directly to home networks, or through apps and cloud services, are all potentially at risk.

Cybercriminals typically target devices to steal data, access wider networks, or disrupt services. Data from the security industry indicates that while routers are the most common target (representing three-quarters of attacks), appliances are also vulnerable.

While a hacker might not initially appear to gain much from compromising a refrigerator, they could potentially control the device or gather information. As demonstrated in the French supermarket attacks, gaining control allows for disruption and chaos. Devices with cameras pose a privacy risk, while compromised routers can expose network data. Users could face device lockouts, altered settings, or even data theft from online accounts.

Similar concerns exist regarding connected vehicles. In 2015, researchers remotely controlled a Jeep, leading to a recall of approximately 1.4 million vehicles. More recently, a flaw was discovered allowing tracking, unlocking, and starting certain Kia vehicles using license plate information.

While critical infrastructure like power and water networks have robust security measures, consumer devices often lack the same level of protection, making them easier targets for cyberattacks.