Act today Critical Check your exposure
Hackers remotely change freezer settings at European supermarkets
BleepingComputerretail, food
What happened. A cyberattack on refrigeration systems disrupted stores of several supermarket chains in multiple European countries. Hackers remotely changed temperature settings on freezers and cooling systems. Follow-up reports describe a second wave of attacks.
Who is affected. Supermarket chains in several European countries, in the retail and food sectors. The source does not name the products or the chains.
What to do. Review who can reach refrigeration and cooling controllers remotely, and restrict that access to named users and approved paths.
When to act. Act today: an attack on industrial operations: check for the same entry point
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L3.5
- L2
- L1
Why: Refrigeration controllers hold the temperature setpoints (L1) and are managed from supervisory screens (L2), usually through a remote-access path (L3.5).
- Are you exposed?
Check the inventory for refrigeration and cooling controllers with remote management, and test whether any are reachable from the internet or through contractor access.
- If you cannot fix it yet
- Remove direct internet access to refrigeration controllers and their web or management interfaces.
- Require multi-factor authentication and an allowlist for any remote-access path used by refrigeration contractors.
- Set alarms on temperature changes that someone must acknowledge, and keep a manual check routine.
- Watch for
- Changes to temperature setpoints on freezers and cooling units outside planned maintenance.
- Remote logins to refrigeration controllers or contractor accounts from unfamiliar locations or at unusual times.
- ATT&CK for ICS
- T0831Manipulation of Control
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: BleepingComputer (opens bleepingcomputer.com)
More on Retail Food and agriculture