Following IT security incidents at supermarkets in Germany and numerous other European countries, operators in some cases had to destroy food after attackers manipulated refrigeration control systems reachable over the internet.
BSI, the German federal cybersecurity agency, has learned of IT security incidents at individual supermarkets in Germany and several other European countries. Attackers accessed refrigeration control systems reachable over the internet and manipulated them, forcing operators in some cases to destroy food. The agency says general supply security in Germany is not at risk. BSI again explicitly urges operators to properly secure their control systems and to block direct internet access to them.
Already in early October, after similar incidents including in France, BSI published its own cybersecurity recommendation aimed specifically at operators of small industrial plants, such as food refrigeration or power generation units. The recommendation lists a few easily implemented measures: block direct internet access to control systems, secure remote access through VPN and an additional authentication factor, keep systems updated with timely security patches, and regularly check whether plants are unintentionally reachable from the internet.
BSI president Claudia Plattner warns that such open entry points practically invite sabotage and could find imitators in any country. What remains unclear is how quickly operators of smaller stores and plants without their own IT department will actually apply these simple measures, even though the agency describes them as straightforward. Companies running networked refrigeration or control systems would do well to quickly check which of their systems are reachable from the internet at all.
What this means for decision-makers
- Disconnect control systems from direct internet access and use secured VPN connections.
- Add a second authentication factor for all remote access to plant systems.
- Run a scan to check which of your systems are currently reachable from the internet.
This story was produced automatically from the source named above and checked by software before publication. The image is symbolic and shows neither the event nor a real person. How this paper is made