When someone asks me what I do for a living, I usually take a breath before answering. Business continuity, crisis management, information security, data protection, emergency planning, exercising, training…. People’s eyes start to glaze over somewhere around the third item, and I can see them filing me under “something in IT” or “health and safety, probably”.
This week a group of attackers in France gave me a much better answer. If you want to know what I do, look at what happened to French supermarkets on Sunday night, and then think about everything that had to happen afterwards.
What happened
Late on Sunday evening, attackers remotely took control of the defrost function on refrigeration systems in hundreds of French supermarkets. Defrost cycles were reportedly pushed to around 50°C, and Le Monde reports that in some cold rooms a one-hour cycle was stretched to eight hours, which held off the alarms that should have warned staff. One Intermarché in Normandy said temperatures reached 80°C and some equipment melted. Many shops only found out when staff arrived in the early hours of Monday.
The reported victims include Intermarché, Netto, Coopérative U, Carrefour Market, Monoprix and E.Leclerc. The numbers have firmed up since Monday, although they still vary depending on who you ask. Les Mousquetaires, which owns Intermarché and Netto, has given figures between 180 and 300 of its stores. Carrefour and Coopérative U have each confirmed around 80, Monoprix about 30, and E.Leclerc “several”. The head of Les Mousquetaires has put the cost at tens of millions of euros across France, from a single night.
Chilled and frozen food had to be thrown away, and the Paris prosecutor has said fires were among the damage reported, although their causes have not yet been established. The Prime Minister has asked ANSSI, France’s national cyber security agency, to take the case on, and ANSSI is talking to its European counterparts in case other countries are exposed. Its director general has said it is urgent for operators to take these controllers off the internet or filter access to them very tightly. The systems involved are refrigeration controllers made by the Danish manufacturer Danfoss.
At the time of writing nobody has said publicly how the attackers got in, or who they are. I’m not going to speculate on either. What interests me is that this one incident touches every part of the work I do, and that very few organisations would have had all of those parts joined up on Sunday night.
Information security: who owns the fridge?
Ask most IT teams for a list of the devices on their network and you will get laptops, servers, phones and printers. Ask them about the refrigeration controller in the back office of store 147 and there is a good chance they will look at you blankly. That kit is often specified by facilities, installed by a refrigeration contractor, managed remotely by the same contractor and never appears on anybody’s asset register.
Anyone who has been through an ISO 27001 audit with me knows I go on about the asset inventory. This is why. You cannot patch, segment or monitor something you don’t know you have. You also can’t plan to replace something you have forgotten about. Danfoss has said that most of the affected equipment is legacy hardware that no longer receives software or security updates, and that it has long been urging customers to move off those models. In other words, kit that had quietly gone out of support was still running a function that hundreds of shops depend on every night. Nobody has confirmed exactly how the attackers got in yet, but when equipment is past the point of being patched, every known weakness in it stays open for good.
There’s a second lesson in why so many of these controllers could be reached at all. Many supermarket control panels are connected to the internet so that maintenance firms can look after them remotely. That’s convenient, and it saves call-out costs, but the French government has now described putting a management interface straight onto the internet as contrary to best practice. Remote access for suppliers should be limited to known, trusted connections and reviewed like any other access to your systems.
Supply chain: the risk you bought in
This is the part I find most telling. None of these retailers wrote the vulnerable software. They bought refrigeration equipment from a reputable manufacturer, probably through installers and maintenance contractors, and the weakness came in with it. That’s what third party risk looks like in practice. E.Leclerc has described the incident as a cyber attack on one of its refrigeration equipment suppliers, and the French retail federation has called on Danfoss and the installers for full transparency.
It also explains why so many chains were hit at once. When a large share of an industry relies on the same supplier, a single weakness becomes a sector-wide problem overnight. Competitors who would normally pick up the slack when one chain has a bad day are dealing with exactly the same thing.
Then think about recovery. Every affected store now needs refrigeration engineers, replacement parts and a clean bill of health for its controllers, all at the same time. There are only so many engineers. Distribution centres need to restock hundreds of stores simultaneously, and the growers and manufacturers behind them have to absorb a surge in orders. Contracts with suppliers and maintenance firms rarely say anything useful about what happens when everyone needs them on the same morning.
Business continuity: one store or three hundred?
Most retail continuity plans I’ve seen would cope reasonably well with a refrigeration failure. Fridges break down. Power cuts happen. There are usually procedures for moving stock, checking temperatures by hand, and deciding what can be sold and what has to go.
They also assume someone knows there is a problem. Here the attackers reportedly stretched the defrost cycle so the alarms didn’t go off, and in some stores the first warning was a member of staff walking into a warm cold room hours later. The other trouble is that those procedures nearly always assume one site, with help available from the others. A deliberate attack that hits hundreds of sites in a single night breaks that assumption completely. It is also a good illustration of why I keep pushing clients to think about their minimum business continuity objective rather than a single recovery time. Can a store keep trading ambient goods with the chilled aisles closed off? For how long? At what point does it make more sense to shut the doors? Those are decisions to make calmly in advance, not at five o’clock on a Monday morning with a store manager on the phone.
Crisis management: decisions under pressure
Fires change everything. The moment there is a risk to life, this stops being an IT incident or a stock loss and becomes an emergency. Somebody has to decide whether to evacuate, whether to isolate equipment that may still be under someone else’s control, and whether it is safe to switch anything back on.
Several of the chains involved are cooperatives or groups of independent store owners, which adds another layer. Who has the authority to tell three hundred separately owned businesses what to do, and how quickly can that instruction reach every one of them? Who decides that a cold room full of stock is to be destroyed, and who records the evidence the insurers and investigators will want later? None of this is technical, and all of it needs to have been thought through before the night it is needed.
Communications: the empty aisle problem
Photographs of taped-off freezer aisles were all over social media by Monday morning. Customers want to know whether the food they bought on Saturday is safe. Staff want to know what to tell people and whether they will be paid if their store closes. Food safety regulators, the police, the press, suppliers and shareholders all want answers, and every one of them needs a slightly different message.
The temptation in the first few hours is to say too much or nothing at all. Speculating about who did it is a trap, as is promising that everything will be back to normal by Tuesday. Good crisis communications is mostly about saying clearly what you know, what you are doing about it and when you will next update people, and then keeping that promise.
Recovery: longer than the headlines
By the time the story drops out of the news, the real work will only be getting going. Controllers have to be checked, rebuilt or replaced, and someone has to be confident the attackers no longer have a way back in before anything is reconnected. Spoiled stock has to be disposed of safely. Insurance claims need evidence, and Intermarché has already warned that its insurance may not cover this kind of incident. That’s a question every organisation should be asking its broker now, not after the event. Supplier relationships will be tested, and customers who went elsewhere this week may not come back.
This is where a proper post-incident review earns its keep. I prefer to talk about lessons identified rather than lessons learned, because a lesson hasn’t been learned until it has changed what people actually do. The organisations that come out of this well will be the ones that turn the review into changes to contracts, asset registers, plans and training.
Why this matters in the UK
It would be easy to read this as a French problem. It isn’t. The same types of refrigeration controller are used in supermarkets, cold stores, distribution centres and food manufacturers across Europe, and the cold chain doesn’t stop at retail. Pharmacies, hospitals, care homes, schools and caterers all depend on equipment that keeps things cold and that increasingly connects to the internet so a contractor can look after it remotely. Internet scans reported this week found exposed Danfoss controllers in a number of countries, the UK among them, although France accounted for most of them.
I wrote recently about the National Audit Office’s work on the resilience of our critical food supply chains. This attack is a very practical example of how fragile those chains can be when one shared component fails, whether by accident or by design.
If you want somewhere to start, I’d ask a few simple questions this week. Do you know which of your building and equipment systems are connected to the internet, and who can reach them remotely? When did your refrigeration, heating or building management contractor last update the firmware, and how would you know? Does your continuity plan cope with the same failure at every site at once? Who has the authority to close a site or destroy stock, and have they ever practised making that call?
So, what do I do?
I don’t run into the burning supermarket. My job is the work that happens before and after: helping organisations understand where they are exposed, including through their suppliers, writing plans that people can actually use, training the people who will have to make the decisions, and running exercises so the first time they face something like this isn’t the real thing. Afterwards, I help them work out what happened and make sure the lessons identified turn into something better.
Information security, supply chain risk, business continuity, crisis management, communications and recovery. It turns out you can explain all of it with a supermarket freezer.
