In addition to running controllers with outdated firmware, the affected businesses likely also failed to put the devices behind a VPN and create a limited list of IP addresses that are allowed to log in. These protections are standard but often not followed. In this case, that failure enabled a mass hack that likely cost tens or hundreds of millions of euros. Spain, Portugal, Poland, Germany and Belgium would also be affected.
“Two things could have changed the outcome,” researchers at Pen Test Partners said Wednesday. “Cyber hygiene would have prevented access: remove the controller from the public Internet, put remote access behind a VPN and an IP whitelist, bring third-party kit onto the network in a controlled, owned and documented manner instead of leaving it on a contractor’s own connection, change known and standard credentials, and patch to an up-to-date release.
Researchers from the security company Claroty warned the threat to ignore these common sense steps last October. The US Cybersecurity and Infrastructure Security Agency did the same in February.
In an email, Copeland acknowledged a vulnerability “identified in a deprecated, end-of-life generation of controllers” and said the company is working with customers to prevent similar incidents in the future. Danfoss representatives did not immediately respond to questions. CNN said the company also cited discontinued models.
So far, the party behind the attack has remained silent. This raises the possibility that the motive was vandalism on a massive scale. Another possibility is a nation-state or other international actor aiming to create a continent-wide disruption.
The incident underscores the tensions between the finance and security departments at most businesses. Some companies do not want to spend large sums of money on new equipment if there are no tangible benefits or savings. Only after a devastating hack do they realize why the investment was worth it. Executives at the affected supermarket chains are likely to learn the hard lessons. Less clear is whether the cautionary tale will sway other businesses.