German watchdog warns some cooling systems remain vulnerable to hacking

Germany's information security office BSI ​warned on Friday of ​ongoing vulnerabilities in some ‌of Danish ​firm Danfoss' industrial cooling appliances, following cyberattacks on refrigeration systems across Europe. The systems in ‌question should be taken offline when possible or otherwise any connection should be secured via VPN, or Virtual Private Network, BSI said in ‌a security advisory on its website.

Hacking attacks on European supermarkets spread ‌across the continent last week, hitting fridges and freezers from Sweden to Belgium and forcing stores to throw away food in an incident that echoed a similar ⁠attack ​in France ⁠last month. At least some of the refrigerator units affected used temperature control technology from ⁠Danfoss that was also targeted in the French attack.

The German office said ​IT security managers should also check whether they can install ⁠updates available from the company. It warned, however, that Danfoss had not yet ⁠provided sufficient ​software updates to counter the attacks. "Even new patches do not guarantee that further vulnerabilities in an affected product will not ⁠come to light in the near future. Industrial control systems should therefore ⁠not be directly ⁠accessible from the internet."

The United States last week also warned of a "cyber threat" to industrial refrigeration ‌systems.