A business cybersecurity review should include controls for physical equipment. The US National Institute of Standards and Technology, NIST, classifies these systems as operational technology: they monitor or change physical processes. For a food business, this means reviewing the refrigeration control chain too.
What happened in Estonia, and what is known about Latvia?
ERR reported on 2 November that attackers changed a refrigeration setting to +50°C at one Selver supermarket in Estonia. The actual temperature rose by 2–3 degrees, and a timely response prevented food losses.
Attempts were detected in Latvia, but by the evening of 2 November there were no reports of successful breaches of major grocery chains’ refrigeration systems. CERT.LV expert Gints Mālkalnietis explained this to LSM. An attempt is not a confirmed breach.
What should you check with the equipment contractor?
France’s CERT-FR alert on refrigeration controllers recommends removing direct internet exposure, checking configurations, including defrost intervals, and following manufacturers’ update guidance. Insurance contract conditions should also be reviewed before disconnecting remote data transmission.
CISA and partner agencies highlight the following measures for protecting operational technology networks:
- Replace default passwords with strong, unique ones.
- Provide essential remote access through a protected VPN with multifactor authentication.
- Separate equipment control networks from office IT networks.
- Disable unused accounts and restrict access rights.
- Practise a safe switch to manual control.
“Everything is secure” is not a sufficient answer
Our editorial recommendation for management: ask the contractor for a one-page inspection summary. Include the equipment, responsible person, inspection date, identified issue and remediation deadline. Record separately who can change settings and who receives alerts outside working hours.
Ask a practical question: what happens if an alert arrives at night and the first contact does not answer? Test the backup contact arrangements and agree who can call out a technician. Equipment maintenance and incident management may be separate contractual responsibilities; it is worth allocating them clearly.
Assess security spending against potential business costs: the value of stock at risk, downtime, disposal and delivery delays. This is a business risk calculation, not a claim about the losses caused by this particular incident.
What if the settings have already been changed?
Involve the equipment contractor and the person responsible for IT. Coordinate recovery actions with the safety requirements of the particular equipment. CERT.LV accepts incident reports on its round-the-clock number, +371 67085888, and provides initial response guidance.
Management should also arrange a separate product quality assessment: a temperature reading returning to normal does not establish what happened to the goods beforehand.
Organising everyday business operations
You can look for potential partners in business listings and explore services for businesses for administrative tasks. Have technical security assessed by an appropriate specialist; a listing alone does not demonstrate competence.
Official information sources
- NIST — operational technology security guidance
- CERT-FR — refrigeration controller alert
- CISA, FBI and partners — protecting operational technology networks
- CERT.LV — responding to a cyber incident
Comments
No comments yet. Yours could be the first!
Add a comment