The Guardian reported this yesterday evening:
Hackers have forced the temperature of many French supermarket fridges up to 50C overnight, in an “unprecedented” cyber-attack affecting several hundred stores across the country, with fires and food losses reported.
The Paris prosecutor's office said on Monday the large-scale attack was “affecting connected refrigerators in several major food retailers across France”. Reported damage included “food losses and fires”, it added.
Hundreds of supermarkets have been involved.
Why did this happen?
These supermarkets tried to remove people from their systems, sending the message that they didn't trust them to control a thermostat.
I do not condone what happened, but people are fighting back.
Why should anyone be surprised? When we remove autonomy from people and send subliminal messages of implied worthlessness as a consequence, dissatisfaction will result.
Economies and companies are not about maximising financial returns by increasing, however marginally, something like automating freezer temperatures might have done. They are about serving, engaging with, and respecting people.
When will we learn?
The reaction to this will focus on criminality. In the world we have, that is what it is. But, in my opinion, the cry for help implicit in it will not be heard. And that worries me.
Thanks for reading this post.
You can share this post on social media of your choice by clicking these icons:
There are links to this blog's glossary in the above post that explain technical terms used in it. Follow them for more explanations.
You can subscribe to this blog's daily email here.
And if you would like to support this blog you can, here:
Buy me a coffee!
What might have been the reasons for the installation of an obviously vulnerable sytem into the care structure of a life-necessary commodity?
Supposed economy
What happened wrt French supermarket (probably all of em) is something like:
“boss I think we could save a bit of money by having some sort of remote control over fridge thermos’ – we have lots of them and even a few Euros a fridge adds up”
This would be then followed by the imbecilic idea of centralising (with a nice bit of Internet) coupled to leaving some backdoors (did you change all the factory defaults?) open. This is what I would have done. Local control and monitoring with remote monitoring feed back to HQ. HQ sees summat wrong? pick up the phone (speaker at one end, mic at other – handle in between). This did not happen cos staffing in supermarkets is cut to the bone. For most control systems you do “failure mode” – what can go wrong (malicious or otherwise). Good to see that French supermarkets went through that process. Not
Maybe also a comment on the idiocy of connecting everything to the internet (the so called “internet of things”). My oven has an internet connection. I struggle to envisage a scenario where controlling the oven remotely would be either useful or safe.
How often do supermarket fridges need to be adjusted? How often would this conceivably be need to be done remotely? Why on earth does a fridge have the ability to heat to 50°C? Perhaps it’s me going crazy.
I refuse to control my house from my phone.
“These supermarkets tried to remove people from their systems, sending the message that they didn’t trust them to control a thermostat.”
Can you elaborate on what this means? I don’t see anything in the linked article about this.
thx
I imagined how this arose.
Given my experience, it is not hard to do.
I extrapolated from the article.
I share your concern about how organisations treat people, but I think this incident is the wrong one to hang it on. Nothing reported so far tells us who did this or why. Attacks on connected infrastructure usually come from ransomware gangs, state-linked groups or politically motivated hackers, not from aggrieved staff or citizens. Calling it a cry for help gives the attackers a motive they haven’t claimed.
Remote fridge monitoring also isn’t really about distrusting people with a thermostat. It exists for food-safety record-keeping, for overnight failures when no one is in the store, and for energy costs. The people hurt here were shop workers facing fires and ruined stock.
There is a real lesson, though. When one platform controls hundreds of stores, a single breach becomes a national event. Systems should fail safe and let local staff take back control. That is the case for human autonomy I’d want to make
Look at the systemic issue, though, please….
I think you are missing it by a mile.
I suppose they called them “smart” fridges. Now, they will have to employ lots of humans to clean up the mess.
When a company says it hasn’t been hacked, they are either lying, or next on the list, or they will confess in a few days, once the leaks get going.
We are experiencing a 21st century (and complicated) Luddite revival, and like the originals, although v destructive, they raise some v valid concerns.
When you reduce down controls to anything, when you centralise something, there is always the risk of who then controls that narrow focus of control and how robust and manageable/accountable that is. It’s not diversifying control at all – which is what a good system should do in my opinion especially when spread out. Systems need sub-systems – and that includes people.
Again, its like Tolkien’s ‘ring of power’ isn’t it?
Yes, in a word
I am starting to wonder why we connect so much electronic information. I think there is probably a lot that is unnecessary and could be stored locally. This French example seems to be a case in point. Why should somebody in Paris need to know the temperature of a fridge in Bordeaux?
This interconnectivity is creating a problem which is a actually avoidable.
I think you are right.
It’s possible to include some government blame in this story. The Supermarket companies face high labour costs and regulations. Night shift thermostat minding would be a dull job to boot and long term night shift work is bad for health, so you might want to hire someone in Malaysia during daylight there to do it remotely, but I expect French Labour Laws don’t allow that.
Hence the automation which turned out to have a vulnerability.
You do realise almost every supermarket has a night shift, don’t you? As usual, your claims make no sense.
Richard the point is that the supermarkets brought into the savings by employing less staff that they were told would be the benefit. Lets forget about the need to have new equipment to be able to allow the software to monitor the temperature and their costs along with the cost of the software and support systems.
This is acceptable because you are reducing your level of employees who we know have holidays and can have days off with illness. The loss of the food at a critical time in the world is overlooked. It’s covered no doubt by insurance. Premiums will go up of course but that’s understandable.
It seems to me that this headlong pursuit of using technology for it’s own sake on the premise that it saves on employee costs is a very short term outlook. Even establishing a routine where those checking stock levels or refilling fridges and freezers made a note of temperatures would surely cost less than what has happened?
Much to agree with
As one who wrote their first computer software over 50 years ago and have continued till now, I have always thought that those who connect control systems to the internet are taking a big risk. We have all sorts of people connected to the internet including the Dark Web which no one can shut down. The company I worked for in the 80s and 90s had 2 factories. These were linked by a dedicated link. Before the growth of internet access this was the normal way of doing this. I think we need a new secure internet where users are vetted before being connected.
When my firm first had email in the early ‘ 90s, one computer not on our network, which had email for internal communication, was connected to the web. Times have changed
The reports suggest that the oversight work was outsourced to a Danish software company, which was hacked.
You can guarantee that the accountants recommended this as a cost saver. But the Danish company needs to employ French sub contractors to do the physical work.
Perils of not understanding what you are outsourcing nor the hacking risk.
Rather like the UK selling off the National Air Traffic Service (NATS), and running airports from Fareham. As we have seen recently having IT systems that do not function 100% all of the time is inviting trouble. You will recall the proposed upgrade to the NATS IT system does not yet have back up included. One hopes that that view changes.
I can hope, but seeing action would be better.
It’s difficult to understand how a fridge temp can be raised to 50C since they can’t be run in reverse. Could this be more scaremongering?
Thanks for the nice pic of the teasels earlier, it’s unusual to see so many heads together.