CSA urges Singapore firms to restrict control systems from web after European supermarket attacks

SINGAPORE - A critical advisory has gone out to organisations urging them to restrict systems from public internet exposure and enforce robust authentication measures.

The advisory from the Cyber Security Agency of Singapore (CSA) on Nov 6 comes after suspected cyberattacks on supermarket fridges and freezers across Europe forced retailers to discard spoiled food.

“Recent cyberattacks targeting refrigeration management across Europe have highlighted broader cybersecurity risks associated with internet-connected operational technology (OT),” said CSA in its advisory.

“While these incidents involved refrigeration systems, they are illustrative of a wider and growing threat: poorly secured remote access to OT control systems can allow threat actors to manipulate physical processes and disrupt operations across different sectors.”

OT is the hardware and software used to monitor and control physical assets ranging from industrial equipment and utility grids to cold storage, building management and healthcare facility management systems.

“While CSA has not received reports of similar incidents in Singapore, we should not wait for an incident to happen here before taking precautions,” said Gwenda Fong, chief executive of CSA, in a LinkedLin post on Nov 6.

“Do you know which of your systems are accessible from the internet? Are remote access arrangements adequately secured? Are vulnerabilities being identified and addressed? What about your customers’ personal data? Are they properly managed and secured? These may seem like basic questions, but they are important ones,” she said.

The first wave of attacks hit hundreds of French supermarkets in mid-October. In the first week of November, supermarkets in 10 other European countries including Germany and Finland were also hit.

Within the same week, the disruption extended to the health sector. On Nov 4, France’s Health Ministry said a cyberattack had taken out systems that monitor and control cold rooms at three regional blood banks but staff managed to move the affected blood supplies to other fridges.

Both blood-bank cold rooms and supermarket fridges rely on electronic controllers, some of which are connected to the internet for remote maintenance and adjustments, to keep their contents at the right temperature. The hackers reportedly gained remote access to these controllers.

In its advisory, CSA also urged organisations to identify and maintain an inventory of remote management systems, controllers and other OT devices that are directly accessible from the Internet. 

Among the things organisations should do is to ensure that OT software, firmware and associated network devices are updated with the latest security patches and firmware provided by their respective vendors. 

The Straits Times understands that most supermarket operators and food importers in Singapore do not connect their fridge controllers to the internet.

The Singapore Food Agency (SFA) said cyberattacks have so far caused no disruption to Singapore’s food supply. It is monitoring developments in Europe and is in touch with major retailers and cold-chain warehouses about their cybersecurity. 

CSA said it is working with SFA and supermarket operators to strengthen the security of their networks and systems.

CSA added that the recent cyberattacks against European supermarkets serve as a warning of how vulnerabilities in remotely accessible OT control systems can be exploited to disrupt physical operations, with potentially serious consequences for safety, continuity and supply chains.

Ryan Flores, director of threat research at cybersecurity company TrendAI, said some internet-connected controllers require no login or still use factory-set passwords that are easy to guess. 

If attackers gain access through a maintenance contractor, they could reach equipment at several customers’ premises, he said.

Aaron Ang, chief information security officer at Singapore-based IT services company Wissen International, said the events in Europe showed how easily attackers could cause widespread public anxiety without disrupting key infrastructure like the power grid, water systems or banks.

“You just need to find something ordinary, connected and unprotected fridges this time. Next time it could be lifts, or hotel rooms, or the chillers at a wet market,” said Ang.

Given that Singapore imports more than 90 per cent of its food, Ang said that the risk begins well before food reaches the supermarket. 

A shipment may pass through several cold rooms on its way from the port to distribution centres and shops. If cooling fails at any point, operators in Singapore will have less time to react in the tropical heat.

“A freezer that fails in Sweden in November has hours or even a day before the food is a problem. Here, with 32 degrees outside, you have a much shorter window,” said Ang.

Singapore’s National Blood Programme is jointly managed by the Health Sciences Authority and the Singapore Red Cross, supplying to all hospitals here. Blood bank refrigeration is a prime example of OT.

Many older OT systems were designed with few safeguards against online threats. It is not known if AI was used in the European attacks, but the technology has reportedly discovered many vulnerabilities in older systems.

In the food trade, the concerns extend to the conveyor belts, robotic sorters and packaging machinery in automated warehouses, said Professor Steven Wong, director of the Centre for Digital Enablement at the Singapore Institute of Technology.

“Attackers who compromise these systems could disrupt warehouse operations, interfere with deliveries, manipulate environmental conditions or disable equipment needed to process and distribute food.”

Other businesses depend on similar controls, Prof Wong said. At a manufacturing plant, tampering with machinery could halt a production line or put workers in danger. At a hotel or shopping mall, a breach of the building’s central controls could disable lifts, cut air-conditioning or interfere with door locks.

How exposed a business is depends on the equipment it uses, the software version it runs, who can access it remotely and whether the manufacturer still provides security updates, said Andy Prakash, founder and chief executive of IT security company Privacy Ninja.

For refrigeration operators, he advised checking with manufacturers for known flaws and fixes, and closing off unnecessary internet access.

If support for a vulnerable controller has ended, replacing that component may be enough to keep the fridge in service, he said. For larger, older systems that are difficult to replace, businesses can isolate the equipment on a separate network and restrict access while they plan an upgrade.

A weakness uncovered at a supermarket could give a hospital or warehouse an opportunity to act if it uses the same controller or contractor, said Flores, arguing for more information sharing.

“Information about affected equipment, vulnerabilities and access methods should help operators across sectors check their exposure and act sooner. The aim is to shorten the time vulnerable systems remain exposed, rather than wait for evidence of damage at each business.”