Attackers have hit internet-connected refrigeration controllers in supermarkets and food shops across Europe for the second time in a month, forcing fridges and freezers into defrost mode and stores to throw away food. The UK’s National Cyber Security Centre (NCSC) has warned organisations here that could be at risk.
What happened
- Overnight into Monday 2 November, controllers were changed remotely in shops in Belgium, the Netherlands, Luxembourg, Sweden, Estonia, Ireland, and other countries; more than 100 stores were reported affected, and Belgium’s federal prosecutor opened an investigation.
- It follows a similar attack on supermarkets in France in October. Equipment maker Danfoss said its products were involved, and France’s CERT has also named Copeland and Dixell controllers.
- NCSC chief executive Richard Horne said the NCSC had alerted a handful of UK organisations and was aware of a couple of cases where vulnerable technology had been exploited. He said it was too early to say who was responsible.
Why it mattered
It showed that ordinary building equipment left on the internet can cause real losses quickly, and in many countries at once.
Lessons for organisations
Find every connected controller in your premises, including those your suppliers manage, take management interfaces off the internet or put them behind a VPN, and change default passwords. Include operational technology in your asset register and incident plans (ISO/IEC 27001 controls A.5.9 and A.5.24).
Source: SecurityWeek
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
