More than 100 controllers that operate refrigeration systems at commercial sites in Bulgaria are potentially vulnerable to cyberattacks. This was warned by cybersecurity expert Hristiyan Daskalov on NOVA NEWS’s programme “Your Day”. According to him, there is no public information that the devices in Bulgaria have been attacked, but their accessibility via the internet creates a risk.
The controllers regulate the temperature in refrigerators and cold-storage chambers. If compromised, attackers can change their settings, which could lead to the stored goods spoiling.
“Such devices regulate the temperature in refrigerators and cold-storage chambers. If they are compromised, attackers can change their settings and thus cause the stored goods to spoil,” Daskalov said.The cybersecurity expert added that in similar attacks in Europe, food products worth tens of millions had already been discarded. In the specific case, no country or company was identified, nor was the exact amount of the damage disclosed.
According to Daskalov, the controllers can be found through the publicly accessible internet search engine Shodan. It displays devices and services that are accessible online, including when access to them was not intended for a broad range of users.
“Controllers for refrigeration systems should not be directly accessible via the internet,” the expert explained. He clarified that in some cases such a connection is left in place for convenience, when an external provider needs to monitor and manage the equipment remotely.
Daskalov said he had sent a report on an identified vulnerability to one of the major retail chains so that measures could be taken. The company’s name was not disclosed.
His recommendation to other retailers is to check whether the controllers at their sites are visible online. If they are accessible, the connection should be restricted. It is also necessary to check whether the devices’ software has been updated to the latest version.
“It is also important to check whether their software has been updated to the latest version,” Hristiyan Daskalov stressed.