Germany’s Federal Office for Information Security (BSI) has learned of IT security incidents at individual supermarkets in Germany and several other European countries. Unauthorised third parties manipulated control systems of refrigeration units that are reachable over the internet. In some cases, food had to be destroyed as a result.
The BSI states that supply security in Germany is not at risk. It had already warned in early October, after comparable incidents in France, and has published a cybersecurity recommendation describing the most important technical measures. The recommendation is aimed in particular at operators of small industrial or comparable facilities, such as those used for cooling food or generating electricity.
BSI President Claudia Plattner said the incidents in France clearly show how cyberattacks can affect and disrupt everyday life. According to her, the attack could have hit any country and could find imitators at any time. She added that such entry points practically invite sabotage.
The first measure is to block direct internet access to control systems. In addition, the BSI recommends VPN systems and multi-factor protected access, and keeping systems up to date with security updates and bug fixes applied promptly.
Operators should also check whether their devices or facilities are exposed and take concrete countermeasures. According to the BSI, these measures should become routine to raise the security level significantly.
