In addition to running controllers with outdated firmware, affected stores likely failed to place devices behind a VPN and create a restricted list of IP addresses allowed to connect. These protections are standard but often not respected. In this case, this failure allowed a massive hack that probably cost tens, if not hundreds of millions of euros. Spain, Portugal, Poland, Germany and Belgium are also believed to have been affected.
“Two things would have changed the result,” Pen Test Partners researchers said Wednesday. “Cyber hygiene would have prevented access: remove the controller from the public internet, put remote access behind a VPN and IP allowlist, bring third-party kit onto the network in a controlled, owned, and documented manner rather than leaving it on a contractor’s own connection, change known and default credentials, and apply a patch to a current version. »
Last October, researchers at security firm Claroty warned of the threat of ignoring these common-sense measures. The US Cybersecurity and Infrastructure Security Agency did the same in February.
In an email, Copeland acknowledged a vulnerability “identified in an abandoned and end-of-life generation of controllers” and said the company was working with its customers to avoid similar incidents in the future. Danfoss representatives did not immediately respond to questions. CNN said the company also cited discontinued models.
So far, the party behind the attack has remained silent. This raises the possibility that the motive is large-scale vandalism. Another possibility is that of a nation-state or other international actor aiming to create continent-wide disruption.
The incident highlights the tensions between the financial and security departments of most companies. Some businesses are reluctant to spend large sums of money on new equipment when there are no tangible benefits or savings. Only after a devastating hack do they realize why the investment was worth it. The managers of the supermarket chains concerned will probably learn the hard lessons from this. It is less clear whether this warning will influence other companies.
Gn bussni
