Following recent cyber attacks on European supermarkets, the IoT Security Foundation urges retailers to check that refrigeration controllers and other connected equipment are not directly accessible from the public internet and that all available security updates have been applied.
Retailers may be leaving critical refrigeration equipment exposed to cyber criminals without realising it, the IoT Security Foundation (IoTSF) has warned, following recent attacks targeting supermarket refrigeration systems across Europe.
The IoTSF is calling on retailers to take immediate action to identify connected equipment that can be accessed directly from the public internet, remove unnecessary exposure and ensure that all applicable security patches have been installed.
The IoTSF’s Operations Manager, Chris Bennison, said, “Retailers may have refrigeration controllers and other critical equipment accessible from the public internet without even knowing it. This creates an unnecessary opportunity for cyber criminals to disrupt their operations.
“These attacks demonstrate that criminals don’t need to compromise a company’s corporate IT network to cause serious disruption. A poorly secured refrigeration controller can itself become a target.
“Our message to every retailer is simple: check your connected equipment, remove direct internet exposure and make sure it is patched. Do not assume that your equipment supplier or maintenance contractor has already taken care of this.”
Internet exposure creates an avoidable risk
Modern refrigeration systems increasingly use internet connectivity for remote monitoring, management and maintenance. However, where management interfaces or control services are directly exposed to the public internet, attackers may be able to exploit vulnerabilities or weak access controls to interfere with equipment operation.
The consequences can include spoiled stock, damaged equipment, disruption to trading and substantial financial losses.
The risk is not limited to refrigeration. Heating, ventilation, air conditioning and building management systems may present similar vulnerabilities where connected equipment is inadequately secured.
Although remote access is often necessary for efficient maintenance, it should be provided through appropriately protected connections, with strong authentication and access restricted to authorised personnel.
Refrigeration controllers and other operational equipment should not have their management interfaces or control services directly accessible from the public internet.
Five essential cybersecurity checks for retailers
The IoTSF recommends that retailers work with their equipment suppliers, installers and maintenance contractors to carry out the following checks:
1. Check for direct internet exposure
Identify refrigeration controllers and other connected equipment that can be accessed from the public internet. Remove unnecessary exposure of management interfaces and control services. Where remote access is essential, use appropriately secured VPNs or equivalent protected access solutions, with strong authentication and access restrictions.
2. Ensure equipment is patched and up to date
Confirm with equipment manufacturers and maintenance providers that installed systems are running supported firmware and software, and that all applicable security updates have been installed. Identify equipment that is no longer supported and establish appropriate mitigations or replacement plans.
3. Strengthen passwords and access controls
Ensure default passwords have been changed, strong and unique credentials are used, and access is limited to authorised personnel. Use multi-factor authentication for remote access wherever supported.
4. Review third-party maintenance connections
Establish how equipment suppliers and maintenance contractors access systems remotely. Verify that these connections are secure and that responsibility for security updates, vulnerability management and access control is clearly defined.
5. Identify and protect all connected operational equipment
Maintain an inventory of connected equipment and review its network security. Refrigeration, heating, ventilation and building management systems should be appropriately segregated from corporate IT and payment networks, with access restricted to operational requirements.
Cybersecurity must extend beyond traditional IT
Retailers have traditionally concentrated their cybersecurity efforts on corporate IT systems, payment infrastructure and customer information. However, connected operational equipment can present equally significant risks to business continuity.
Compromising a refrigeration controller may not expose customer data, but it can disrupt essential operations, damage equipment and lead to substantial losses through spoiled stock.
These incidents reinforce the need for retailers to understand the security of all connected equipment, including systems supplied, installed and maintained by third parties.
Security is a responsibility throughout the product lifecycle
The IoTSF has consistently advocated that cybersecurity must be built into connected products and maintained throughout their operational lifetime.
Manufacturers and suppliers have an important role in ensuring that products are securely configured, security vulnerabilities can be addressed through software updates and remote maintenance facilities are appropriately protected.
Retailers must also understand the cybersecurity arrangements for the equipment they operate and ensure that security remains effective throughout its service life.
The IoTSF’s message is clear: do not wait for an incident. Check connected equipment now, remove direct internet exposure and ensure that available security patches have been installed.