The National Cyber Security Centre (NCSC) reports multiple cyberattacks on refrigeration systems from various suppliers in Europe, including the Netherlands. The centre is monitoring the situation, conducting investigations and advising organisations that operate refrigeration systems.
Attackers can exploit vulnerabilities in internet-connected refrigeration systems or gain access through weak or default passwords. This allows them to change settings remotely, such as the temperature or defrost cycles. As a result, systems may not function properly or may fail.
The NCSC advises organisations to contact their supplier to check whether the system is vulnerable. If this is the case, the system should, according to the centre, be updated immediately. Organisations should also prevent refrigeration systems from being directly accessible via the internet. If remote access is necessary, it should be restricted to trusted IP addresses. The NCSC also recommends strong passwords, regular security updates, and checking settings and suspicious activity.
The attacks can lead to spoiled products, food safety risks, financial damage, waste and potentially the shutdown of the business. Organisations can voluntarily report incidents of misuse to the NCSC or, if they are registered, via MijnNCSC.
According to the NCSC, the Cybersecurity Act has been in force since 15 August. The Act applies to approximately 8,000 organisations in eighteen (very) critical sectors. Larger companies in other sectors and some suppliers may also fall within its scope. In the event of significant cyber incidents, organisations must report them to their sector’s CSIRT and the relevant supervisory authority. The NCSC is the designated sectoral CSIRT for a large number of sectors.
