Unpatched, Internet-Exposed Cooling Controllers Targeted in Critical Infrastructure Attacks
Written by AI from the linked story. Not reviewed by an editor. How this works
Cyberattackers exploited unpatched and internet-accessible industrial cooling controllers in European supermarkets, causing refrigeration failures and significant food spoilage. The root problem is a failure to apply available patches and to isolate operational technology (OT) systems from the public internet — two well-established security hygiene practices. When critical physical infrastructure controllers are reachable from the internet without compensating controls, a single successful exploit can translate directly into real-world harm. This incident underscores that OT/ICS environments carry the same vulnerability risks as IT networks but with far greater physical and financial consequences.
Tactical Insight
Immediate actions
- Audit all cooling and HVAC controllers for direct internet exposure and immediately remove or firewall any that are publicly reachable.
- Apply all available vendor patches to industrial control systems and refrigeration controllers on an emergency basis, prioritising internet-facing assets.
- Change all default credentials on OT devices and enforce strong, unique passwords or certificate-based authentication.
Long-term improvements
- Implement strict network segmentation using demilitarised zones (DMZs) and unidirectional gateways to isolate OT/ICS networks from corporate IT and the public internet.
- Maintain a continuously updated asset inventory of all operational technology devices, including firmware versions and patch status.
- Establish a formal OT-specific patch management programme with defined patching windows and risk-acceptance processes for systems that cannot be taken offline.
Detection measures
- Deploy OT-aware intrusion detection systems (IDS) to baseline normal controller behaviour and alert on anomalous setting changes.
- Enable centralised logging of all configuration changes on industrial controllers and route alerts to a 24/7 monitored SIEM or SOC.
- Conduct periodic penetration tests and vulnerability scans specifically targeting OT/ICS assets to identify exposure before attackers do.