The night someone turned up the heat in France's supermarkets

Short answer. One Sunday night, attackers took over the refrigeration controllers in hundreds of French supermarkets and held the cabinets at 50°C for hours. They didn’t touch a till or a customer record. They went for a grey box in the plant room that was connected to the internet so a contractor could maintain it remotely. Most UK buildings are full of equipment that works the same way, and most of it isn’t managed by anyone in IT.

I wrote the full story as a guest post for EMC Associates, the FM consultancy behind FM Talk. This is the short version. Read the full article on emcassociates.co.uk.

What happened

At around 11pm, the cold room at an Intermarché near Bordeaux started to warm up. By the time a delivery driver arrived at 4am it had reached 50°C, the sprinklers had gone off and the stockroom was under water. No alarm had gone off, because the system meant to raise it was the system that had been taken over.

The same thing happened across France. Intermarché counted around 150 stores, Carrefour 80, and Monoprix and Coopérative U were hit too. Intermarché’s chief executive put the cost at tens of millions of euros in a single day. Reports point to Danfoss refrigeration controllers running outdated firmware, some of them old enough to no longer get updates at all. The attackers didn’t need clever malware. They held the fridges in their normal defrost cycle and turned the temperature up.

The box nobody calls IT

Those controllers were online so engineers could check alarms without a site visit. That saves a callout. It also means anyone who gets past the login is, in effect, standing in the plant room. Researchers had already published flaws in the same controllers in August, and found thousands of their management screens open to the internet.

Now think about your own building at 11pm on a Sunday. Air conditioning and the building management system. Boiler controls, lighting, door access, CCTV, lift monitoring, water temperature sensors, EV chargers, meeting room panels, the vending machines by the lifts. Each one has a network connection, a web login and usually a contractor who connects in remotely. Very few were bought by IT, and the firmware on most of them isn’t tracked by anyone.

For years security meant laptops, servers and email. Now anything with an internet connection is in scope. A lot of that kit is installed by a contractor and then never managed by anyone, and that’s exactly what makes it an easy target.

Separate networks are the bare minimum

Keeping building equipment on its own network stops a compromised device reaching your finance team’s laptops. The Target breach in 2013 started with login details stolen from its refrigeration and HVAC contractor, so that matters. But it does nothing to stop the device itself being taken over, which is what happened in France.

The bigger question is the supplier’s software. Whoever provides the kit should be able to tell you how it’s secured, how remote access works, how long it will get security updates and who applies them. If they can’t answer that before you sign, they won’t be able to answer it after an attack either.

Put it in the contract

That’s where EMC’s angle comes in. Tenders for catering, vending or plant maintenance spell out response times and prices in detail, and rarely ask how the equipment connects to the network or who patches it. The full article covers what to write into those contracts, and how asking suppliers for Cyber Essentials, or Cyber Essentials Plus for higher-risk systems, makes a simple first filter.

If you want to know what is actually connected in your building and who can reach it, that’s part of IT security work, and a free IT review is a good place to start.

Read the full article on EMC Associates.