Europe fridge cyberattacks: CSA urges S’pore firms to restrict web access to control systems

Hackers gained remote access to electronic controllers managing temperatures in internet-connected refrigeration systems. They manipulated those controls, disrupting cooling and forcing retailers to throw away spoiled food. The incidents showed that ordinary equipment can create serious operational risks when remotely accessible.

The first attacks struck hundreds of French supermarkets in mid-October. In early November, supermarkets in 10 other European countries, including Germany and Finland, were affected. On Nov 4, France’s Health Ministry reported that a cyberattack had disabled monitoring and control systems for cold rooms at three regional blood banks.

Staff moved the affected blood supplies to other fridges, limiting the impact. CSA said Singapore had no reported similar incidents, but urged organisations to restrict internet exposure, secure remote access, inventory OT devices and install vendor security updates. The attacks remain a warning for sectors using connected physical systems.

Operational technology is the hardware and software used to monitor and control physical assets. It includes industrial equipment, utility grids, cold storage, building systems and healthcare facility management systems. OT matters because a cyberattack can affect temperatures, machinery or other physical conditions, not merely files or screens.

The European incidents involved electronic controllers that maintained temperatures in supermarket fridges, freezers and blood-bank cold rooms. When attackers reached those controllers remotely, they could interfere with the physical process of keeping supplies cold. This made cybersecurity a safety and continuity issue.

Ordinary information technology generally focuses on information, applications and communications. OT focuses on operating equipment and processes, although the two can be connected. CSA warned that poorly secured remote access to OT can disrupt operations across sectors. Organisations should identify exposed OT devices and secure, patch and monitor them.

The attacks were geographically broad and crossed sectors. The first wave hit hundreds of French supermarkets in mid-October. During the first week of November, supermarkets in 10 other European countries, including Germany and Finland, were also hit.

The disruption then reached healthcare. On Nov 4, France’s Health Ministry said a cyberattack had taken out systems monitoring and controlling cold rooms at three regional blood banks. Staff moved the affected blood supplies to other fridges, preventing the incident from becoming a reported supply loss.

The spread mattered because refrigeration is used far beyond retail. Supermarkets, blood banks, cold-chain warehouses and other facilities depend on temperature control. CSA described the attacks as a warning that remotely accessible OT vulnerabilities can threaten safety, continuity and supply chains. The incidents also showed that major public anxiety can arise without attacks on power, water or banking systems.

Refrigeration controllers regulate the temperature inside fridges, freezers and cold rooms. If attackers gain remote access, they can interfere with monitoring or control. The cooling system may then fail to maintain the required conditions, putting food or medical supplies at risk.

Supermarket fridges and blood-bank cold rooms both rely on electronic controllers. Some are connected to the internet for remote maintenance and adjustments. In the European incidents, hackers reportedly gained access to those controllers. Retailers were forced to discard spoiled food, while staff at three French blood banks moved affected supplies to other fridges.

The key danger is a physical consequence from a digital intrusion. Cooling failure may remain harmful even if other networks and services continue working. CSA warned that such attacks can disrupt operations and supply chains. Singapore’s tropical heat could leave operators less time to react if cooling fails during food transport or storage.

Internet-connected OT systems are exposed because attackers can discover and attempt to reach them remotely. Weak passwords, unchanged factory credentials or missing login requirements make access easier. Outdated software, firmware or network devices may also contain vulnerabilities that vendors have already addressed.

Ryan Flores said some internet-connected controllers require no login or still use factory-set passwords that are easy to guess. If an attacker enters one, the controller may allow changes to refrigeration or other physical processes. The European attacks showed how that access can cause real disruption.

The danger is greater because OT devices often operate important services and supply chains. CSA urged organisations to update OT software, firmware and associated network devices with vendors’ latest security patches. It also recommended restricting public internet exposure and enforcing robust authentication. These steps reduce opportunities for unauthorised access before equipment is manipulated.

Remote maintenance is designed to let contractors monitor or adjust equipment without visiting every site. That convenience can create a shared pathway into many organisations. A contractor may manage refrigeration controllers or other OT devices for several customers.

Ryan Flores of TrendAI warned that attackers who gain access through a maintenance contractor could reach equipment at several customers’ premises. The same trusted connection, account or remote-management arrangement may therefore expose multiple sites. Each site could contain separate physical systems, but the access route connects them.

This creates a multiplier effect. One compromised contractor or poorly secured remote-access system could disrupt equipment across different businesses, rather than only one machine. CSA urged organisations to maintain an inventory of remote management systems and directly accessible OT devices. It also called for robust authentication, limited internet exposure and timely security updates for systems and network devices.

The safest alternative to direct public exposure is to keep OT systems offline where possible. Organisations can also restrict remote access, require robust authentication, update software and firmware, and track every connected controller and management system. These measures reduce the number of routes attackers can use while preserving necessary maintenance.

Sheng Siong said it uses conventional refrigeration and freezer systems that are not connected to the internet. CSA recommended identifying internet-accessible OT devices, securing remote arrangements and applying vendor security patches. Remote access should therefore be limited and controlled rather than openly reachable.

These protections are especially important for Singapore’s food and blood-related supply chains. Singapore imports more than 90% of its food, and shipments may pass through cold rooms from the port to distribution centres and shops. If cooling fails, tropical heat gives operators less time to react. CSA is working with SFA and retailers to strengthen networks and systems.