Hundreds of grocery stores hacked in France

Saw this earlier in the news. I realize real time ability to control things is more efficient, but sometimes more resilient systems are more important than ultra efficient systems. Food distribution would be one of those times in my opinion.

These systems should only be pushing out data to a monitoring dashboard with all modifications needing to be done on site. Not VPNed in. On the freezers directly. A dashboard with alerts would still allow problems to be addressed quickly, it will just require someone to go on site.
 
El_Capitan said:
We entered the era of stupidity, needing freezers and fridges to be connected to the internet...
Click to expand...
If I had to make a guess its so corporate can monitor to make sure the temperatures are the right temps, and if not try to adjust them. But WTF its France not the US if someone gets sick they sue for like 3 days wages for having diarrhea, and that's it
 
This is why I am vehemently against "smart" devices, especially stupid shit like smart fridges and the devices that were hacked in France are basically that but in bigger scale. Fridge has only one job, be a insulated box with a door and cooling device that is controlled by a simple thermostat, that is all no more no less. Why on gods green earth does this have to be connected to the internet and why the fuck do I need to have an ability to adjust remotely when thermostar, if it works correctly, does it so automatically?
 
El_Capitan said:
We entered the era of stupidity, needing freezers and fridges to be connected to the internet...
Click to expand...
Yes so if there is a issue some would be alerted instead of coming in next morning with all refrigeration dead and 10s of thousands of dollars worth of food apoiled.
 
workshop35 said:
Old hardware with old software thats out of support. Seems like they're learning a hard lesson about network segementation/isolation of legacy systems.
Click to expand...
Exactly my thoughts. It's their own fault, they used outdated, end of life Danfoss thermostat controllers, with no security support whatsoever. Exposed on the internet, no doubt. I don't feel sorry for them. Apply joke IT security, receive adequate rewards.
 
Last edited:
vegeta535 said:
Yes so if there is a issue some would be alerted instead of coming in next morning with all refrigeration dead and 10s of thousands of dollars worth of food apoiled.
Click to expand...
That's what workers are for. Let's see, how are they going to get by until they get another new system in place that does the same thing... oh, I know. By using workers to check and make sure everything is working correctly. There's many ways to prevent this, and that's just one. If they want a system exposed to the internet, don't allow for controls, just monitoring. If there's an issue with temperatures, just call the store and tell them to check their temperatures... which they should have a monitoring system in place at the store, with an alarm to go with it, anyway. There should be no controls in place to change it remotely. But, it's there store, they can do whatever they want.
 
In Maine Hannaford markets have shut down their web site due to a possible cybersecurity breach 10-13-26
 
El_Capitan said:
That's what workers are for. Let's see, how are they going to get by until they get another new system in place that does the same thing... oh, I know. By using workers to check and make sure everything is working correctly. There's many ways to prevent this, and that's just one. If they want a system exposed to the internet, don't allow for controls, just monitoring. If there's an issue with temperatures, just call the store and tell them to check their temperatures... which they should have a monitoring system in place at the store, with an alarm to go with it, anyway. There should be no controls in place to change it remotely. But, it's there store, they can do whatever they want.
Click to expand...
Store don't typically have employees there 24/7.
 
Last edited:
El_Capitan said:
That's what workers are for. Let's see, how are they going to get by until they get another new system in place that does the same thing... oh, I know. By using workers to check and make sure everything is working correctly. There's many ways to prevent this, and that's just one. If they want a system exposed to the internet, don't allow for controls, just monitoring. If there's an issue with temperatures, just call the store and tell them to check their temperatures... which they should have a monitoring system in place at the store, with an alarm to go with it, anyway. There should be no controls in place to change it remotely. But, it's there store, they can do whatever they want.
Click to expand...
But workers make a salary, and that costs profit. Far better to have an automated system you can monitor from off-site. [/sarcasm]
 
pioruns said:
Exactly my thoughts. It's their own fault, they used outdated, end of life Danfoss thermostat controllers, with no security support whatsoever. Exposed on the internet, no doubt. I don't feel sorry for them. Apply joke IT security, receive adequate rewards.
Click to expand...
Pretty sure somebody in IT is going to get a PP slap unless they replaced their IT with a bot. Honestly the amount of damage a company is willing to do to itself for the lone purpose of reducing headcount never ceases to amaze me.

This is an excellent reminder for people that keep buying smart appliances though. Your computers need to be secured and that can be complicated when you have a fridge, washer, dryer, dishwasher, microwave, lamp, light switches, oven, cook-top, ice maker, coffee maker, wine chiller, humidifier, etc.... all waiting to be compromised. Or to fuck up just because pretty much all smart appliances are abso-fucking-lute garbage. People would be blown away by how much damage you can do to a home with just their humidifiers, never mind how much you can dick with a fully compromised smart home.

vegeta535 said:
Storez don't typically have employees there 24/7.
Click to expand...
They used to. Grocery stores used to stock shelves every night instead of blocking aisles with skids of Red Bull and granulated sugar all fucking day. That was in the olden times when even huge companies invested in customers both with product and with adequate staffing.
 
Twisted Kidney said:
Pretty sure somebody in IT is going to get a PP slap unless they replaced their IT with a bot. Honestly the amount of damage a company is willing to do to itself for the lone purpose of reducing headcount never ceases to amaze me.

This is an excellent reminder for people that keep buying smart appliances though. Your computers need to be secured and that can be complicated when you have a fridge, washer, dryer, dishwasher, microwave, lamp, light switches, oven, cook-top, ice maker, coffee maker, wine chiller, humidifier, etc.... all waiting to be compromised. Or to fuck up just because pretty much all smart appliances are abso-fucking-lute garbage. People would be blown away by how much damage you can do to a home with just their humidifiers, never mind how much you can dick with a fully compromised smart home.


They used to. Grocery stores used to stock shelves every night instead of blocking aisles with skids of Red Bull and granulated sugar all fucking day. That was in the olden times when even huge companies invested in customers both with product and with adequate staffing.
Click to expand...
I bet they replaced or fired their IT workers when they implemented their system. Or, they have IT workers, who kept telling them to update their system, then ignored them, and fired them because of what just happened. One thing I'm glad of for being unemployed for almost a decade, is I don't have to work for idiots.
 
Couldn't they setup a monitoring system that can alert for failure but not have the ability to remote control temperatures?
 
Kalessian said:
Couldn't they setup a monitoring system that can alert for failure but not have the ability to remote control temperatures?
Click to expand...
But then how would corporate turn the temp down to the absolute min remotely and save money.
Only half joking. I can see reasons to have this level of remote control over commercial refrigeration. IF your going to do that however you gotta build it properly, which clearly they did not.
 
TordanGow said:
Saw this earlier in the news. I realize real time ability to control things is more efficient, but sometimes more resilient systems are more important than ultra efficient systems. Food distribution would be one of those times in my opinion.

These systems should only be pushing out data to a monitoring dashboard with all modifications needing to be done on site. Not VPNed in. On the freezers directly. A dashboard with alerts would still allow problems to be addressed quickly, it will just require someone to go on site.
Click to expand...
Not arguing your point, but adding some devils advocate points from someone who has worked in the industry.

Being able to remote defrost a freezer to save a huge drive or even to limp it while en route is super helpful.

Refrigeration is a "right now" job when most techs are m-f. On call adds time and cost.

A lot of systems that large need tweaking over time to get running like desired. I can watch system performance and adjust set points or whatever from other jobs instead of having to stay on site for days.

That said, security is important, and most places I've been used the simplest passwords and never changed them.
 
As with others, fine I can see the value of monitoring. But that's monitoring, not controlling, i.e. one way, read-only, and if you need to control, you get a real human.

Greed has brought on so much idiocy lately. Especially with anything critical, it should always be about, what presents a potential point of failure? The truth of the matter is nothing is ever 100% secure. The more critical something is, the fewer points of failure should be the goal.
 
Nytegard said:
As with others, fine I can see the value of monitoring. But that's monitoring, not controlling, i.e. one way, read-only, and if you need to control, you get a real human.

Greed has brought on so much idiocy lately. Especially with anything critical, it should always be about, what presents a potential point of failure? The truth of the matter is nothing is ever 100% secure. The more critical something is, the fewer points of failure should be the goal.
Click to expand...
This. Having Plan B as just relying on Plan A is where we have these problems.
 
Kalessian said:
Couldn't they setup a monitoring system that can alert for failure but not have the ability to remote control temperatures?
Click to expand...
End of life Danfoss thermostat controllers were their failure alert system :D But alerts did not arrive due to hack, which most likely turned off notifications and then adjusted temperatures. Just like Iranian centrifuges affected by Stuxnet some years back.
 
In related news, Ahold Delhaize (Food Lion, Hannaford, Stop & Shop, Giant Food in the US) have shut down large parts of their IT infrastructure due to a "security incident":
Ahold Delhaize is experiencing a security issue within its network. Our teams are taking steps to assess and mitigate the issue. This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers.

Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority. We apologize for any inconvenience this issue may have caused customers and partners.
Click to expand...
Source: https://newsroom.aholddelhaize.com/...ry-measures-following-cybersecurity-incident/

I gather that in Europe their supermarkets are rapidly running out of stock.
 
Last edited:
TangledThornz said:
Treat it like a terrorist attack, which it is, and this will happen less often but France won't do shit as always.
Click to expand...
It's not a terrorist attack. Terror by definition is a use of violence against non-combatants. There aren't any violence here. Just a money loss for corporations, which deserved it anyway, due to their extreme negligence.
 
M76 said:
As an European I've never even heard of them, or of any of their brands.
Click to expand...
In Europe they are fairly restricted geographically, with biggest presence in the Benelux area. Ahold used to be much bigger, but nearly bankrupted itself by growing too fast in the early 2000s, then sold of most of what it had acquired.
 
emphy said:
In Europe they are fairly restricted geographically, with biggest presence in the Benelux area. Ahold used to be much bigger, but nearly bankrupted itself by growing too fast in the early 2000s, then sold of most of what it had acquired.
Click to expand...
Apparently they own some bigger chains in Serbia, Romania, and Greece, one would hope that a network outage in their offices in the Netherlands don't cause a supply disruption 1000km away.
 
Nytegard said:
As with others, fine I can see the value of monitoring. But that's monitoring, not controlling, i.e. one way, read-only, and if you need to control, you get a real human.

Greed has brought on so much idiocy lately. Especially with anything critical, it should always be about, what presents a potential point of failure? The truth of the matter is nothing is ever 100% secure. The more critical something is, the fewer points of failure should be the goal.
Click to expand...

All I used to hear in the 2000's and 2010's was "Risk Analysis" and "Data Driven Decisions"! They seem to have stopped talking about that stuff and are now just doing cost cutting without any risk analysis at all. The drive to stoke profits doesn't give a shit if the whole system falls down around their ears because they cut the stuff keeping it afloat.
 
vegeta535 said:
Yes so if there is a issue some would be alerted instead of coming in next morning with all refrigeration dead and 10s of thousands of dollars worth of food apoiled.
Click to expand...
So I do HVACR. You can have temperature alerts be separate from the coolers /freezers controls. Honestly I see no valid reason for having the actual temperature controls be online for things in refrigeration as it's not like your house AC once you put it in and it's installed correctly you shouldn't have to adjust anything it should hold the case temp it's set up for ....if it doesn't it needs servicing.
 
You must log in or register to reply here.
Back
Top