Cyberattacks on supermarkets and what Italy is lacking in terms of cybersecurity

Between Sunday and Monday, in some Italian supermarkets as well, refrigeration units stopped cooling and began to heat up. These are scenes already observed across Europe, in most EU countries, over the past few weeks. In almost all cases, the cause of these malfunctions is a cyberattack. Experts refer to it as hybrid warfare or cognitive warfare: the idea is that adversaries can intimidate or frighten people not with bombs, but by targeting them in their everyday lives.

This morning, at Palazzo Chigi, the Under-Secretary to the Prime Minister, Alfredo Mantovano, is chairing a (semi-)emergency meeting with senior officials from the Postal Police, the Director of the National Cybersecurity Agency and the heads of the intelligence agencies. The aim is to devise a defence strategy to stem the rise in cyber-attacks and, above all, to minimise the damage caused by them.

"The paradox is that Italy is struggling because it is lagging behind on the issue of cyber security, despite having long been ahead of the curve," comments Giuseppe Antonio Costantini in Il Foglio. He spent nearly two decades with the Swiss Postal Police and is now a cyber security consultant for several major groups. “A dozen years ago, a plan was drawn up that was intended to provide for the creation of a designated cybersecurity officer in large companies and a programme of ongoing training for all staff who dealt with computers and devices connected to the corporate network. It was a plan that we in Switzerland have also replicated,” he explains. However, this plan never really became a reality and, above all, never became routine. "The threat is not new; this issue has been the subject of discussion for over twenty years. Something has been done, but not everything and, above all, not enough. What is still not clear is that there is no such thing as a computer-genius hacker who, from a computer, targets a system, breaches its defences and brings it to a standstill. Wargames is a film from 1983; the problem is that there are people who are still convinced that’s how it really works,” says Giuseppe Antonio Costantini. "It’s all much simpler: bait is sent out onto the network and they wait for the fish to take the bait. And you may have the best defence programme, but the critical issue isn’t the programme or programmes you have; it’s always the people who deal with them. The critical issue is the human factor. That’s why we need ongoing training; that’s why we need to increase knowledge and, above all, IT awareness."

Giuseppe Antonio Costantini explains that “the problems experienced by supermarkets are always, or almost always, caused by a silly mistake, a stupid lapse in concentration – in 98 per cent of cases, human error. This does not mean that there is no external destabilisation strategy at play; it means that this destabilisation strategy could be far less problematic if action had been taken in a prudent manner”.

In recent days, The Guardian reported that the root cause of the problems experienced by the Swedish supermarket chain Coop was the "unauthorised tampering" with its refrigeration systems, stemming from an attack on one of its system suppliers, Danfoss – the same Danish company that had supplied the temperature controllers to the French supermarkets that were knocked out in September. “Danfoss is a company with an excellent cyber defence system, yet this system was breached. The reason is likely to be an error or a lapse in concentration on the part of an employee. In an interconnected system, much greater vigilance is required, along with a thorough understanding of what can and cannot be done. And this can only be achieved through continuous training.” For Giuseppe Antonio Costantini, zero risk “is unattainable, but lowering risk thresholds is possible and not even difficult, provided, however, that we truly take into account that so-called cyber security is not a battle between nerds where the most brilliant wins, but stems above all from individual responsibility and an understanding of what must absolutely not be done on a corporate network.”