A wave of attacks on supermarket refrigeration systems has reached Estonia, Estonian World reports. At one Selver shop the attackers accessed a computer used to control the refrigeration system and raised a freezer setting to 50°C. The intrusion was detected and stopped quickly, before it caused damage to goods.
According to Selver, no other shop in its chain still runs the older control system involved, which the outlet identifies as made by Danfoss.
The State Information System Authority has so far had a single report, the one from Selver, and knows of no other case. Selver's refrigeration partner Kitman Coldtech first said further Estonian clients had been hit as well; none has been confirmed publicly. Nobody has claimed the attacks, and why they happen is not known.
The report counts at least 11 European countries with such incidents — Sweden, Belgium, Romania, Germany and the UK among them — though some cases are still under investigation. In Sweden and Belgium a number of stores took chilled and frozen goods off the shelves. A month earlier, attackers in France had tampered with the cooling at hundreds of supermarkets.
Remote monitoring lets a retailer run cooling equipment in many shops from one place, but a controller left reachable from the internet, or protected weakly, opens the same door to an attacker; industrial devices also tend to run for years without updates. The State Information System Authority names exposed and vulnerable devices as the main risk. The Refrigeration Association of Estonia asks operators to make sure their controls are not openly reachable online, to install updates, to replace factory passwords and to go through who has remote access.
Source: Estonian World, . The text above is our own summary; the words in quotation marks are the source's.
What this means for an Estonian entrepreneur
A company whose equipment is maintained by an outside supplier often cannot see who has remote access to it. The four steps the Refrigeration Association names — no open online access, updated software, changed default passwords and reviewed remote access — are worth writing into the maintenance contract, with the supplier named as responsible for each, so the duty does not depend on memory after an incident.
Before you sign or renew a maintenance contract for remotely controlled equipment, we can review whether it names who updates the software, who may connect remotely and who answers for its security. Review of a lease or other contract