9 ms·

The impact is that 20% of Sweden's food supply is locked out. This is larger than what it seems, not just for Swedish meatballs - the underlying Kaseya hack is

The impact is that 20% of Sweden's food supply is locked out. This is larger than what it seems, not just for Swedish meatballs - the underlying Kaseya hack is global. It's truly scary that you can get into these kinds of situations (completely relying on a 3rd party IT), but it's also very costly to have a doubled setup :/

Scoundreller 5y ago
It’s less about doubled setups and more about downtime procedures that don’t have to be perfect but get you by to stay functioning at some level.
- Taek 5y ago
  Agreed, pretty much every physical operation (stores, logistics, etc) should have plans to continue operating when their IT is down. Losing access to dynamic pricing and loyalty discounts is better than closing up entirely.
  - miohtama 5y ago
    This gets hard in no cash society, like what Sweden is already.
    - haskellandchill 5y ago
      with pen and paper books can be kept
      - miohtama 5y ago
        But you cannot pay with a pen at a cash registry
        Scoundreller 5y ago
        It’s a co-op store. They know who you are.
        cpach 5y ago
        It’s a co-op by name only. These days, Coop’s just a regular supermarket.
        Scoundreller 5y ago
        This should be illegal.
        cjg_ 5y ago
        Coop the store chain is owned by a cooperative association (https://en.wikipedia.org/wiki/Kooperativa_F%C3%B6rbundet https://en.wikipedia.org/wiki/Kooperativa_F%C3%B6rbundet) so would say it is legit still.
        detaro 5y ago
        Just because the organization is a co-op (of co-ops in the case of the overall parent org) doesn't mean it knows all members of the public that go shopping there.
        Scoundreller 5y ago
        It doesn't mean they socially know everyone that shows up, but every member would have paid some amount to buy (a) share(s), at least that's how coops work where I am. Plus accumulated dividends. That's a relative barrier to fraud if they decided to issue credit to members. You could still fraud hit them in this circumstance, but they have some kind of info printed on your card with your name on it and how long you've been a member, and somewhere in the background, a phone# and address. If one wanted to commit retail crime, easier to just take stuff and walk out without paying.
    - Scoundreller 5y ago
      Any POS terminal should be able to work with power only. There’s probably a dusty manual somewhere telling you how to configure it for the store to enable it and allow the cashier to type in an amount owing and then hand to the customer and queue payments for upload when network connectivity comes back. Might lose some payments to overdrafts or cancelled cards. But they lived with that with credit cards up until 2000ish. Buy-on-board on Aircraft and trains take advantage of this. Offline payments is baked into EMV payments. It can at least verify the PIN and that the card was valid at its last phone-home. https://www.google.com/search?q=mastercard+emv+offline+payments https://www.google.com/search?q=mastercard+emv+offline+payme...
- logifail 5y ago
  > [..] more about downtime procedures that don’t have to be perfect [..] Once, while waiting to check in for a British Airways flight from Manchester (UK), I noticed several large plastic boxes behind the check-in counters labelled "manual check-in". Presumably someone at BA not only thought about but actually implemented a plan for how to check in passengers when (not if) all the check-in computers go down.
  - deviledeggs 5y ago
    Airlines are fairly immune to technical problems because their systems are so terrible already. Accidental chaos engineering
typhonic 5y ago
Once, while working at a large grocery store, we lost power. The emergency lights came on, but all the cash registers stopped working. One of the managers ran to the back of the store and returned with hand cranks that fit into the side of the cash registers. It was darker, but sales did not stop. The time required to re-train the cashiers was negligible. This cyber attack will probably result in a doubling down of the same technology that put them into this position. Perhaps, in addition, they should look for a lower tech fall back approach.
- ethbr0 5y ago
  A key point is remembering the reason for computerization & automation is efficiency. The difference between less (manual) & more (computerized) efficiency is probably less important than the difference between stopping & continuing operations, in exceptional times. Waffle House and Home Depot (among others) are pretty good at internalizing this, and have processes for running on shoestrings, but still running, until normal support can be restored.
- reader_mode 5y ago
  How do you process cards with hand cranks ? Also these days I think you're legally required to use some sort of government fiscalisation service where each receipt is uploaded as issued or something like that.
  - yissp 5y ago
    I've seen businesses in the US use these things during power outages. https://www.possupply.com/model-4850-flatbed-credit-card-imprinter https://www.possupply.com/model-4850-flatbed-credit-card-imp...
    - ghaff 5y ago
      Most of my cards aren't embossed at this point. They'd have to write the information by hand.
  - ratww 5y ago
INTPenis 5y ago
Coop were handing out bread here today like some disaster movie. But ICA and several other stores are still open so I really don't take this too seriously. This is a classic case of layered out sourcing as I'd like to call it, and no redundancy. They'll learn.
peakaboo 5y ago
That's overly dramatic. We just go to another company brand chain to shop. Plenty of those, so no worries, at least until all food shops run out of food... :)

Scoundreller 5y ago

It’s less about doubled setups and more about downtime procedures that don’t have to be perfect but get you by to stay functioning at some level.

Taek 5y ago
Agreed, pretty much every physical operation (stores, logistics, etc) should have plans to continue operating when their IT is down. Losing access to dynamic pricing and loyalty discounts is better than closing up entirely.
- miohtama 5y ago
  This gets hard in no cash society, like what Sweden is already.
  - haskellandchill 5y ago
    with pen and paper books can be kept
    - miohtama 5y ago
      But you cannot pay with a pen at a cash registry
      - Scoundreller 5y ago
        It’s a co-op store. They know who you are.
        cpach 5y ago
        It’s a co-op by name only. These days, Coop’s just a regular supermarket.
        Scoundreller 5y ago
        This should be illegal.
        cjg_ 5y ago
        Coop the store chain is owned by a cooperative association (https://en.wikipedia.org/wiki/Kooperativa_F%C3%B6rbundet https://en.wikipedia.org/wiki/Kooperativa_F%C3%B6rbundet) so would say it is legit still.
        detaro 5y ago
        Just because the organization is a co-op (of co-ops in the case of the overall parent org) doesn't mean it knows all members of the public that go shopping there.
        Scoundreller 5y ago
        It doesn't mean they socially know everyone that shows up, but every member would have paid some amount to buy (a) share(s), at least that's how coops work where I am. Plus accumulated dividends. That's a relative barrier to fraud if they decided to issue credit to members. You could still fraud hit them in this circumstance, but they have some kind of info printed on your card with your name on it and how long you've been a member, and somewhere in the background, a phone# and address. If one wanted to commit retail crime, easier to just take stuff and walk out without paying.
  - Scoundreller 5y ago
    Any POS terminal should be able to work with power only. There’s probably a dusty manual somewhere telling you how to configure it for the store to enable it and allow the cashier to type in an amount owing and then hand to the customer and queue payments for upload when network connectivity comes back. Might lose some payments to overdrafts or cancelled cards. But they lived with that with credit cards up until 2000ish. Buy-on-board on Aircraft and trains take advantage of this. Offline payments is baked into EMV payments. It can at least verify the PIN and that the card was valid at its last phone-home. https://www.google.com/search?q=mastercard+emv+offline+payments https://www.google.com/search?q=mastercard+emv+offline+payme...
logifail 5y ago
> [..] more about downtime procedures that don’t have to be perfect [..] Once, while waiting to check in for a British Airways flight from Manchester (UK), I noticed several large plastic boxes behind the check-in counters labelled "manual check-in". Presumably someone at BA not only thought about but actually implemented a plan for how to check in passengers when (not if) all the check-in computers go down.
- deviledeggs 5y ago
  Airlines are fairly immune to technical problems because their systems are so terrible already. Accidental chaos engineering

typhonic 5y ago

Once, while working at a large grocery store, we lost power. The emergency lights came on, but all the cash registers stopped working. One of the managers ran to the back of the store and returned with hand cranks that fit into the side of the cash registers. It was darker, but sales did not stop. The time required to re-train the cashiers was negligible. This cyber attack will probably result in a doubling down of the same technology that put them into this position. Perhaps, in addition, they should look for a lower tech fall back approach.

ethbr0 5y ago
A key point is remembering the reason for computerization & automation is efficiency. The difference between less (manual) & more (computerized) efficiency is probably less important than the difference between stopping & continuing operations, in exceptional times. Waffle House and Home Depot (among others) are pretty good at internalizing this, and have processes for running on shoestrings, but still running, until normal support can be restored.
reader_mode 5y ago
How do you process cards with hand cranks ? Also these days I think you're legally required to use some sort of government fiscalisation service where each receipt is uploaded as issued or something like that.
- yissp 5y ago
  I've seen businesses in the US use these things during power outages. https://www.possupply.com/model-4850-flatbed-credit-card-imprinter https://www.possupply.com/model-4850-flatbed-credit-card-imp...
  - ghaff 5y ago
    Most of my cards aren't embossed at this point. They'd have to write the information by hand.
- ratww 5y ago

INTPenis 5y ago

Coop were handing out bread here today like some disaster movie. But ICA and several other stores are still open so I really don't take this too seriously. This is a classic case of layered out sourcing as I'd like to call it, and no redundancy. They'll learn.

peakaboo 5y ago

That's overly dramatic. We just go to another company brand chain to shop. Plenty of those, so no worries, at least until all food shops run out of food... :)