The police have already recorded at least 10 cyberattacks on store refrigerators and cold stores in Poland - RMF FM journalists learned. Similar incidents have been taking place in various countries for several weeks - criminals remotely raise the temperature in refrigerators, thus destroying food.
The most dangerous attacks are on blood storage devices
Krzysztof Smaga, an engineer, trainer and expert in the field of cybersecurity, points out that refrigeration systems are increasingly connected to the Internet, which allows them to remotely monitor their operation, but at the same time creates new opportunities for cyber attacks.
We live in the era of the Internet of Things. We connect almost everything to the network: lamps, vacuum cleaners, cameras, industrial devices. And any device connected to the network can become a potential target of an attack, he said.
According to the analyzes he cited, two groups linked to Russia are probably behind the recent attacks on refrigeration infrastructure. He assessed that this type of operations require significant resources and can be used to demonstrate strength and demonstrate the possibility of disrupting the functioning of the enemy's infrastructure.
One of the most dangerous scenarios is an attack on devices used to store blood intended for transfusion. Smaga reminded that blood must be stored under strict conditions, and violating them may make it unfit for use.
We cannot simply produce any amount of blood to replace what is lost. We are dependent on blood donors for transfusions, he emphasized.
As he explained, the loss of blood supplies could make it difficult to perform surgeries, treat severe injuries and save patients in life-threatening emergencies.
Cyber attacks on refrigeration systems may also hit the food sector
According to the expert, disruption of the operation of large logistics centers that supply many stores at the same time would be particularly dangerous.
Then it is not enough to go to the neighboring supermarket, because it can also be supplied by the same logistics center. The effects of a cyber attack may go far beyond one company, he noted.
Another potential target is air conditioning systems in data centers. Smaga explained that servers generate huge amounts of heat, so interrupting their cooling may lead to overheating of the devices and automatic shutdown of the equipment, and in extreme cases even damage it.
This does not automatically mean the paralysis of the entire country, but customers using the services of a given data center could lose access to them, he noted.
How do cybercriminals gain access to data?
The expert pointed out that cybercriminals can gain access to industrial systems, among others, by phishing, i.e. extorting access data from employees, and by exploiting vulnerabilities in device software. The problem is rare updates and sometimes complete lack of manufacturer support. The attack does not have to involve a sudden shutdown of the cold store. It may manifest itself as a gradual increase in temperature, which employees consider a simple malfunction.
For a person who is not involved in cybersecurity, the incorrect operation of a cold store will look like a regular failure, Smaga noted.
In his opinion, the level of preparation of Polish enterprises and institutions is very diverse. Some have appropriate security measures, procedures and trained staff, but others still believe that cybersecurity is only a cost that does not bring direct profits.
The problem is that the consequences of a serious incident may be much more expensive than the security measures that were previously saved, he emphasized.
What do experts recommend to enterprises?
The expert recommended companies primarily:
separation of industrial devices from other elements of the IT network,
securing remote connections,
preparing plans to maintain operations and restore systems after an attack,
regular employee training.
Smaga assessed that the implementation of new requirements related to the EU NIS2 directive should increase investments in security and staff preparation.
The most important thing is that we stop treating cybersecurity as an unnecessary cost and start perceiving it as a condition for the safe operation of an enterprise, he concluded.
Not only Poland
In October, approximately 700 supermarkets in France were hit by a cyberattack targeting refrigeration installations. Hackers took control of refrigerators and freezers and then changed temperature settings, leading to food spoilage and financial losses in stores. At the beginning of November, cyberattacks on refrigeration systems were also confirmed by, among others, Ireland, Sweden, Belgium, Portugal and Luxembourg.
In France, cybercriminals also attacked blood storage refrigerators belonging to the French Blood Donation Institute. They tried to raise the temperatures there.
For commercial entities using refrigeration systems, the police recommend verifying the network, refrigeration controllers and the control panel and checking whether they are accessible directly from the public IP address, changing infrastructure passwords, updating software and implementing security patches and the latest versions of firmware issued by device manufacturers.
What are the recommendations for the health sector?
In turn, the CSIRT (Cyber Security Incident Response Team) of the e-Health Center emphasizes that it is also important to strengthen the monitoring of changes in the configuration and operating parameters of critical devices, test incident response procedures and business continuity plans, remove default accesses and replace them with new ones in accordance with the strong password policy.
