German supermarkets have become targets of cyberattacks on refrigeration systems, following a large-scale attack on supermarket cooling equipment in France three weeks earlier. The incidents have highlighted security weaknesses in systems used to control store refrigerators and freezers remotely.
The cooling units at one or more stores can be adjusted through centralized software. According to computer scientist Manuel Atug of the Critical Infrastructures Working Group, some retailers connected systems containing small web servers directly to the internet without proper controls. That can allow anyone who reaches them online to manipulate the equipment, he said. Atug said supermarket cooling controls should at least be protected by a firewall.
Under German law, retailers that supply at least 500,000 people are classified as critical infrastructure. Atug noted that organizations serving fewer people may still fall into other categories of important facilities and have cybersecurity obligations.
Haya Schulmann, a cybersecurity professor at Goethe University Frankfurt, said many suppliers and service providers that organizations depend on are not covered by critical-infrastructure protections. Weaknesses in those parts of supply chains could delay construction or repairs to important transport and utility facilities, she said, arguing that protection should extend to suppliers and service providers.
A study by the National Research Center for Applied Cybersecurity found security shortcomings even in federal ministries, including outdated devices connected to networks, known vulnerabilities that had not been fixed, and a lack of requirements for service providers. Schulmann said official security assessments also overlook a substantial part of IT systems in Germany, stressing that responsible security bodies need to know which systems exist.
Researchers say artificial intelligence could help attackers identify vulnerabilities more quickly and with less technical expertise, but it could also support faster repairs. Loui Al Sardy, a cybersecurity expert at Friedrich-Alexander University Erlangen-Nürnberg, said perfect security has never been possible. Research therefore focuses on making systems resilient enough to keep operating after an attack.
Al Sardy said AI systems used for security need to work reliably with unfamiliar or manipulated data, produce decisions that can be understood, and have known limitations. Safeguards for security, privacy and human oversight are also necessary, he said.
Sources: Tagesschau.