COMMENTARY: Over the past six weeks, Europe has experienced a series of cyberattacks targeting commercial refrigeration systems, exposing vulnerabilities in the operational technology (OT) that supports essential services.
The first wave of attacks occurred Oct. 11, when cyber attackers targeted internet-connected freezers and refrigerators in grocery stores across France. By manipulating temperature controls, attackers caused significant food spoilage and financial losses across approximately 700 stores.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
In early November, a second wave targeted retail and commercial refrigeration systems in multiple European countries, including Belgium, Estonia, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K. Around the same time, attackers also targeted three regional blood storage facilities operated by the French Blood Establishment.
Following these attacks in Europe and suspected attacks on U.S. military commissaries domestically, the FBI and CISA issued a warning to critical infrastructure organizations to start locking down cold systems.
Now, reports emerged that France’s National Cybersecurity Agency (ANSSI) attributed the attacks in Europe to Iranian military hackers. That’s an understandable assessment given that in each incident across Europe, attackers gained access to the industrial control systems governing refrigeration equipment.
Iran’s cyber capabilities in targeting critical infrastructure are well documented: earlier this year, Iranian hackers also targeted U.S. water treatment facilities, demonstrating their ability to exploit vulnerabilities in industrial control systems.
What we’re witnessing
Although the attacks unfolded in multiple waves, the broader pattern deserves attention. These incidents may represent a coordinated hybrid campaign targeting systems that control essential services, which points to an increasingly concerning threat landscape.
Cybercriminals and potentially hostile foreign actors have discovered that they don't need to target a nation's military or financial institutions to cause significant disruption. They can instead exploit the connected technologies that control our food supply, healthcare facilities, transportation networks, and other essential services.
The implications extend well beyond stolen data or compromised networks. When attackers gain control of physical systems, the consequences can include spoiled food, disrupted medical services, financial losses and potential threats to public safety. In this new reality, cybersecurity is no longer just about protecting information: it's about protecting the physical systems and essential services that people depend on every day.
The long-term motive: probing for a bigger attack
Beyond the immediate chaos and disruption, these incidents raise another important concern: threat actors may use smaller-scale attacks to test their capabilities, tactics, and procedures ahead of potentially larger operations.
These types of probe attacks let adversaries identify weaknesses, assess response capabilities, understand how organizations detect and contain intrusions, and determine which vulnerabilities could get exploited again. In other words, the immediate damage may only represent part of the objective. The intelligence gathered along the way could prove even more valuable in a future attack.
The pattern emerging across Europe should serve as a warning to the U.S. Both regions face a complex cyber threat environment in which criminal ransomware groups, politically motivated hacktivists, and nation-state intelligence services can target essential services, government institutions, transportation networks, and major businesses.
Organizations responsible for critical infrastructure must begin treating the security of internet-facing operational technology with the same rigor they apply to their traditional IT environments. Many of the most effective protections are foundational cybersecurity practices that have been recommended for years: strong, unique passwords; multifactor authentication; timely patching; continuous monitoring; and well-defined incident response plans.
Three takeaways from the attacks in Europe
There are three important lessons that critical infrastructure organizations should take away from these incidents:
- The real vulnerability lies in the convergence of IT and OT: Refrigeration controllers, building management systems, medical equipment, and other industrial devices are increasingly connected to enterprise networks and managed remotely. Yet, many were never engineered to operate in hostile internet-facing environments. As IT and OT environments become more interconnected, attackers have more opportunities to move beyond traditional enterprise systems and compromise the physical processes they support. Organizations must understand where these connections exist, identify potential exposure points and implement appropriate controls to prevent an intrusion in one environment from spreading to another.
- Even small-scale compromises can have cascading economic and safety consequences: A relatively limited intrusion can force businesses to dispose of food, disrupt retail operations, trigger regulatory concerns, and undermine public confidence. In healthcare environments, the consequences are often even more serious, potentially putting medical supplies, blood products and patient safety at risk. These incidents demonstrate that we can’t measure the impact of a cyberattack solely by the number of compromised systems or records. Organizations must also consider the downstream consequences when critical equipment and physical processes are disrupted.
- Operational resilience has become just as important as cyber prevention: It’s not possible to prevent every attack. Organizations must also prepare to detect anomalies, contain incidents and maintain essential operations when systems are compromised. The French blood storage facilities reportedly protected their inventory by detecting abnormal conditions and transferring products to unaffected equipment. This illustrates the value of having processes that extend beyond traditional cybersecurity controls. Independent alarms, manual overrides, network segmentation and regularly tested contingency procedures can help organizations limit damage and maintain operations even during an active attack.
Prepare for what's next
The industry needs to treat these attacks across Europe as an early warning for American critical infrastructure, not as a distant problem with little relevance to U.S. organizations.
Threat actors have increasingly recognized that disrupting the systems behind essential services can be just as effective as targeting the networks and data that organizations have traditionally prioritized. And if these incidents are serving as probes for more sophisticated operations, the next wave of attacks could have far greater consequences.
Critical infrastructure organizations must take a proactive approach to secure connected devices, strengthen visibility across IT and OT networks, and establish response and recovery plans that account for physical as well as digital disruption.
Resilience now depends not only on an organization's ability to prevent an intrusion, but also on its ability to recognize an attack, contain its effects. and keep essential services running.
James Turgal, vice president of global cyber risk and board relations, Optiv
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
