Latest Retail Freezer/Chiller Cyber Attacks: Comment & Analysis

Once again retailers chiller cabinets and fridges have been hacked, here are some comments;

TMK

Paul Gooch, Deputy Departmental Head, Cyber & Enterprise Risk at Tokio Marine Kiln says that insurers should expect “demand to grow for coverage that addresses cyber-triggered physical damage”

“Retail, like other sectors, is exposed to cyber incidents with physical consequences, and these two incidents in quick succession suggest a pattern. It should come as a warning to businesses with machinery and equipment connected directly or indirectly to the internet, as threat actors increasingly look to exploit control system technology to cause maximum disruption. 

Retailers have spent years strengthening defences against data breaches and ransomware attacks, but operational technology such as that used in stores and warehouses is typically configured to prioritise availability rather than security. Given how central these systems are to modern business operations, however, a security compromise can result in significant operational issues.

For businesses that depend on temperature-controlled inventory, for example, it raises the question of whether their insurance covers physical damage as a result of a cyber incident. Many cyber and property policies contain exclusions or limitations on physical damage caused by a cyber event, which can leave gaps when coverage falls between the two. To combat this, we expect demand to grow for coverage that addresses cyber-triggered physical damage, and businesses should review their dependencies on third parties in the supply chain.”

COALITION

Danfoss supervisors were hit in the October 12 attack. Coalition’s data shows 1,668 exposed hosts. Copeland controllers were then involved in the November 1 wave of attacks. Coalition’s scanning data shows 1,638 exposed hosts.

Together, they reach 87 countries. France, Portugal and Sweden are almost entirely Danfoss. Italy, the US, Canada, Czechia, Greece, Bulgaria and Ireland are Copeland territory. The Netherlands is split almost evenly. France (909), Italy (412), the United States (278), Portugal (145), and the Netherlands (120) have the highest numbers of exposed controller hosts detected.

Note: These are raw counts and should not necessarily be correlated with the likelihood of attack. Exposed hosts were counted when our scanning found an internet-reachable page identified as a refrigeration controller’s login or status page. Coalition counts one host per IP address within each controller group and includes IPv4 only. So “exposed” means reachable and identifiable by potential attackers. Country assignments are based on IP registration, not the scan location.