Second wave of refrigeration system attacks

The attacks targeted refrigeration control systems, causing freezers and refrigeration units to heat to temperatures exceeding 50°C, resulting in spoiled stock, store disruption and significant financial losses.

The earlier 'French' incident reportedly impacted hundreds of supermarkets and has costed an estimated €10 million. It has demonstrated how cyberattacks against Operational Technology (OT) can move beyond data theft and directly affect physical processes and business operations. Some sites reported equipment damage and fires as a result of manipulated refrigeration controls.

Systems involved

Many of the devices involved are reported to be legacy or end-of-life products and were reportedly accessible via web-based management interfaces exposed to the public internet. The XWEB systems have also been identified to have 23 vulnerabilities (21 of which are high severity) all relating to authentication and predictable password generation. For example the Username = Admin & Password = Current Date…..

Why were these systems vulnerable?

While investigations remain ongoing and no threat actor has been formally identified, several recurring OT security weaknesses have been highlighted:

• Internet-facing control system interfaces
• Default or weak credentials  
• Legacy systems no longer receiving security updates
• Inadequate network segmentation
• Excessive exposure of management services
• Limited visibility of deployed OT assets and their security posture.

 In some reported cases, devices were accessible through standard web browsers using weak authentication mechanisms, making them attractive targets for opportunistic attackers.

Key lessons for OT environments

Although the affected systems were refrigeration controllers, the lessons apply equally to industrial automation, manufacturing, utilities, energy, water, transport, and other critical infrastructure sectors.

This incident reinforces the importance of:

1. Comprehensive Asset Inventories

You cannot protect assets you do not know exist. Organisations should maintain accurate inventories of OT devices including:

• Hardware models
• Firmware versions
• Software versions
• Network addresses
• Remote access methods
• Support and lifecycle status.

Asset inventories should identify unsupported and end-of-life equipment so remediation plans can be developed before vulnerabilities are exploited.

2. Secure System Hardening

Default credentials should never remain in service.

Security hardening should include:

• Removal of default accounts and passwords
• Strong authentication policies
• Disabling unused services
• Secure configuration baselines
• Regular configuration reviews

 The reported use of predictable authentication mechanisms demonstrates how basic hardening failures can lead directly to compromise.

3. Minimise ports and services

A fundamental OT security principle is to enable only the services required for operations.

Examples include:

• Disable unused web servers
• Remove unnecessary management interfaces
• Restrict remote access protocols
• Disable unused ports and network services.

Every enabled service increases the attack surface available to an attacker.

4. Never Expose OT Devices Directly to the Internet

Perhaps the most important lesson from these attacks is that operational technology devices should not be directly accessible from the public internet.

Remote support requirements should instead be delivered through:

• Secure remote access platforms
• Jump hosts
• VPNs
• Firewalls
• Demilitarised Zones (DMZs)
• Multi-factor authentication.

Direct internet exposure of controllers, PLCs, HMIs, SCADA systems, and industrial appliances creates unnecessary risk and significantly increases the likelihood of compromise.

Current situation

At the time of writing, no organisation or nation-state has claimed responsibility for these attacks, and no ransom demand has been reported. Investigators currently believe the activity is more consistent with sabotage and operational disruption than traditional financially motivated ransomware activity.

Takeaway

For those of us working with IT, OT or on industrial control systems, this incident serves as a reminder that strong cybersecurity fundamentals remain the most effective defence.

Accurate asset inventories, secure hardening, removal of default credentials, reduction of unnecessary services, network segmentation, secure remote access, and preventing internet exposure of OT devices are all well-established controls. However, when these fundamentals are overlooked, the consequences can quickly become physical, operational, and highly visible.

Yoan Jones is automation consultanct at ITI Group

www.itigroup.com