CERT Polska, Poland’s computer security incident response team, identified 140 refrigeration devices visible on the internet, which could make them easier for cybercriminals to attack.
The team contacted the owners, and around 70 companies disconnected their devices from the internet following the intervention. Some devices belonged to large, well-known retail chains. Dudek explained that several refrigerators could sometimes be located in one store and belong to the same supplier.
CERT Polska chief Marcin Dudek said one cyberattack on a refrigerator had been confirmed in Poland. It caused no material losses because the operator disconnected the device from the internet and moved the products stored inside to another refrigerator.
Dudek said the attacks were not complicated. Perpetrators scanned the internet for accessible devices and tested simple passwords and vulnerabilities in software that had been known for many years.
He advised owners not to expose refrigeration equipment directly to the internet. Where remote access is needed by staff or service technicians, it should be provided securely.
Shops and wholesalers in at least nine European countries were affected by cyberattacks, including the UK, Germany, Belgium, Sweden and Finland.
Attackers took control of refrigeration systems and changed temperature settings, causing food to spoil and resulting in losses worth millions of pounds.
In France, refrigeration systems at three facilities storing blood and plasma were also attacked. France's health ministry said safeguards worked and no blood products were lost. The perpetrators of the attack remain unknown.
According to The Times, two pro-Russian hacker groups claimed responsibility for the attacks on retailers.
The US Department of Justice links the groups to an organisation funded by Russian military intelligence. However, authorities have not confirmed who was responsible for the wider series of attacks.
NATO Military Committee Chairman Admiral Giuseppe Cavo Dragone said serious consequences of a cyberattack could provide grounds for invoking Article 5, the alliance's collective-defence clause.
(sp)
Source: IAR/PAP