Advisory on Cyberattacks Targeting Remotely Accessible Operational Technology Control Systems

What is affected, what to do

Recent cyberattacks on refrigeration management systems highlight the risks of poorly secured remote access to Operational Technology (OT) systems, potentially causing operational disruptions and safety hazards. This advisory outlines key measures to strengthen OT security and mitigate similar threats.

The available sources name no fixed version. Check the vendor guidance in the references below.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Recent cyberattacks on refrigeration management systems highlight the risks of poorly secured remote access to Operational Technology (OT) systems, potentially causing operational disruptions and safety hazards. This advisory outlines key measures to strengthen OT security and mitigate similar threats. Background Recent cyberattacks targeting refrigeration management across Europe have highlighted broader cybersecurity risks associated with internet-connected operational technology (OT). In October and November 2026, cyberattacks affected hundreds of supermarkets in France and subsequently other European countries, including Belgium, Luxembourg, Sweden and Ireland. Threat actors reportedly gained unauthorised remote access to refrigeration management systems and manipulated temperature settings, resulting in food spoilage, financial losses and operational disruptions. In a separate incident, refrigeration systems at facilities operated by France's national blood service were reportedly affected following a cyberattack involving a refrigeration equipment supplier. While these incidents involved refrigeration systems, they are illustrative of a wider and growing threat: poorly secured remote access to OT control systems can allow threat actors to manipulate physical processes and disrupt operations across different sectors. Threat Against Remotely Accessible OT Control Systems OT control systems — including industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs) and building management systems — are increasingly connected to the internet or to corporate networks. This remote access enables operators and third-party service providers to monitor, manage and maintain equipment at scale, improving operational efficiency and reducing the need for on-site support. While such connectivity offers significant operational benefits, poorly secured remote access can leave these systems vulnerable to potential compromise. Based on publicly available information, the recent attacks in Europe reportedly involved the exploitation of poorly secured, internet-accessible refrigeration controllers. Weak or default credentials, outdated software and insufficient access controls were identified as potential security weaknesses. The precise intrusion methods used across all affected systems remain under investigation. Once unauthorised access is obtained, threat actors may manipulate equipment settings, disable safety alarms, or disrupt normal operations. Depending on the systems targeted, such activities could result in physical damage to equipment, safety hazards, service disruptions, financial losses and broader impacts on critical operations or supply chains. In sectors relying on cold-chain operations, for instance, such disruptions could compromise temperature-sensitive conditions, with downstream consequences for product safety and supply chain integrity. Similar risks exist across a wide range of OT environments, including but not limited to, energy and utilities infrastructure, water treatment and distribution systems, manufacturing and industrial facilities, building management and HVAC systems, cold-storage and logistics operations, and healthcare facility management systems. Recommendations SingCERT recommends that organisations operating remotely accessible OT control systems review their cybersecurity posture and implement the following measures: a. Restrict Internet Exposure of Remote Management Interfaces Identify, create and maintain an inventory of remote management systems, controllers and other OT devices that are directly accessible from the Internet. Periodically reassess internet-exposed assets to account for changes in the operational environment, such as the addition of new devices, changes to network configurations or the onboarding of new vendors. Remove unnecessary internet exposure and ensure that remote management interfaces are not publicly accessible. Disable unnecessary services, ports and remote functions to reduce the attack surface on each device. b. Strengthen Authentication and Access Controls Change all default passwords and ensure that strong, unique passwords are used for remote management systems and connected devices. Where remote access is operationally necessary, use secure remote access solutions, such as Virtual Private Networks (VPNs). Review and restrict access to authorised personnel and trusted service providers only and ensure that external parties are granted access only to systems necessary for, and specific to their work. Remove accounts that are no longer required. Enable Multi Factor Authentication (MFA) wherever supported. Allowlist the IPs and accounts that may reach controllers and management interfaces and block all other IPs and accounts. Permit only required specific vendor or maintenance channels and block other outbound connections from the controllers. c. Update and Secure OT Systems and Devices Ensure that OT software, firmware and associated network devices are updated with the latest security patches and firmware provided by their respective vendors. Review equipment that has reached end-of-life or is no longer supported by its manufacturer and implement appropriate compensating controls or replacement plans. d. Implement Network Segmentation and Security Monitoring Segregate OT networks from corporate IT networks and other non-essential systems to limit the potential impact of a compromise. Monitor remote access activities and system configuration changes for suspicious behaviour, including unauthorised logins, unexpected changes to operational parameters and modifications to alarm or safety settings. Implement robust logging and alerting mechanisms to facilitate the timely detection and investigation of suspicious activities. e. Strengthen Operational Monitoring and Incident Response Ensure that personnel can identify and respond to unexpected equipment behaviour, including unauthorised configuration changes or abnormal readings. Develop and regularly review incident response and business continuity procedures, including the ability to safely isolate affected systems, revert to local or manual controls where supported, and maintain critical operations during a disruption. Conduct regular training and exercises for staff to be familiar with the incident response procedures. In the event of a suspected compromise, promptly alert relevant technical personnel and equipment vendors to investigate and contain the incident, as well as implement mitigation measures and business continuity procedures. Report the incident to the relevant authorities in accordance with applicable obligations. Perform post-incident reviews, document lessons learnt and strengthen cybersecurity controls to reduce the likelihood and impact of future incidents. Conclusion The recent cyberattacks against European supermarkets serve as a warning of how vulnerabilities in remotely accessible OT control systems can be exploited to disrupt physical operations, with potentially serious consequences for safety, continuity, and supply chains. Organisations across all industries that rely on internet-connected OT systems should proactively assess their cybersecurity posture and implement appropriate safeguards to reduce the risk of similar incidents. References https://www.reuters.com/world/europe/european-supermarkets-rush-patch-vulnerabilities-after-region-wide-fridge-hack-2026-11-03/ https://cybersecuritynews.com/french-blood-plasma-freezers-hacked/ https://www.cyber.gov.au/alert/protecting-operational-technology-and-edge-devices https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems

Source: CSA/SingCERT