About 50 Vulnerable Refrigeration Systems Identified in Latvia

Attempted cyberattacks on refrigeration equipment control systems have been observed in Latvia over the past week, the cyber incident response institution Cert.lv told the LETA news agency. About 50 potentially vulnerable units, whose control systems are exposed to the internet, have been identified in the private sector. That does not mean all of them are compromised, but such exposure significantly raises the risk of attack. The warning matters to businesses using remotely managed industrial equipment, given similar incidents elsewhere in Europe.

What is known about the incidents

According to Cert.lv, no Latvian retail chain has been affected, but an incident was recorded at a warehouse. The attack was stopped, so losses are minimal. Cert.lv has contacted the owners of the equipment concerned, informed them of the risks and provided recommendations. This year the institution has helped to eliminate more than 300 security threats linked to industrial control systems.

So-called freezer attacks in Europe have mainly targeted food retail and storage companies. This week, however, an incident was publicly reported in France in which attackers manipulated temperature settings on blood plasma storage equipment. Significant consequences were avoided. Cert.lv urges medical institutions, laboratories, pharmaceutical companies and medical goods distributors to check the security of their systems.

How attackers gain access

Attackers usually exploit poorly protected systems rather than one specific vulnerability. One scenario is searching for internet-accessible control panels with outdated software or weak passwords. Another is entering through a company's general network when industrial equipment is not separated from office IT infrastructure. Cert.lv recommends VPN, multi-factor authentication, unique passwords, regular software updates and an independent temperature monitoring system, since attackers can also falsify the readings shown on screens.

The risk is not limited to freezers: heating boiler, water pump, ventilation and solar power control systems may also be at risk.

Attackers and retailers' responses

No one has publicly claimed responsibility, and no state's conclusions on the attackers' origin are known. Cert.lv believes the aim is most likely not financial gain but disrupting equipment operation.

Maxima Latvija has preventively strengthened security measures and has not detected attack attempts. Lidl Latvija and Rimi Latvia have also not encountered cyberattacks.