Advisory
Advisory on Cyberattacks Targeting Remotely Accessible Operational Technology Control Systems
6 November 2026
Recent cyberattacks on refrigeration management systems highlight the risks of poorly secured remote access to Operational Technology (OT) systems, potentially causing operational disruptions and safety hazards. This advisory outlines key measures to strengthen OT security and mitigate similar threats.
Background
Recent cyberattacks targeting refrigeration management across Europe have highlighted broader cybersecurity risks associated with internet-connected operational technology (OT). In October and November 2026, cyberattacks affected hundreds of supermarkets in France and subsequently other European countries, including Belgium, Luxembourg, Sweden and Ireland. Threat actors reportedly gained unauthorised remote access to refrigeration management systems and manipulated temperature settings, resulting in food spoilage, financial losses and operational disruptions. In a separate incident, refrigeration systems at facilities operated by France's national blood service were reportedly affected following a cyberattack involving a refrigeration equipment supplier.
While these incidents involved refrigeration systems, they are illustrative of a wider and growing threat: poorly secured remote access to OT control systems can allow threat actors to manipulate physical processes and disrupt operations across different sectors.
Threat Against Remotely Accessible OT Control Systems
OT control systems — including industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs) and building management systems — are increasingly connected to the internet or to corporate networks. This remote access enables operators and third-party service providers to monitor, manage and maintain equipment at scale, improving operational efficiency and reducing the need for on-site support. While such connectivity offers significant operational benefits, poorly secured remote access can leave these systems vulnerable to potential compromise.
Based on publicly available information, the recent attacks in Europe reportedly involved the exploitation of poorly secured, internet-accessible refrigeration controllers. Weak or default credentials, outdated software and insufficient access controls were identified as potential security weaknesses. The precise intrusion methods used across all affected systems remain under investigation.
Once unauthorised access is obtained, threat actors may manipulate equipment settings, disable safety alarms, or disrupt normal operations. Depending on the systems targeted, such activities could result in physical damage to equipment, safety hazards, service disruptions, financial losses and broader impacts on critical operations or supply chains. In sectors relying on cold-chain operations, for instance, such disruptions could compromise temperature-sensitive conditions, with downstream consequences for product safety and supply chain integrity.
Similar risks exist across a wide range of OT environments, including but not limited to, energy and utilities infrastructure, water treatment and distribution systems, manufacturing and industrial facilities, building management and HVAC systems, cold-storage and logistics operations, and healthcare facility management systems.
Recommendations
SingCERT recommends that organisations operating remotely accessible OT control systems review their cybersecurity posture and implement the following measures:
a. Restrict Internet Exposure of Remote Management Interfaces
Identify, create and maintain an inventory of remote management systems, controllers and other OT devices that are directly accessible from the Internet.
Periodically reassess internet-exposed assets to account for changes in the operational environment, such as the addition of new devices, changes to network configurations or the onboarding of new vendors.
Remove unnecessary internet exposure and ensure that remote management interfaces are not publicly accessible.
Disable unnecessary services, ports and remote functions to reduce the attack surface on each device.
b. Strengthen Authentication and Access Controls
Change all default passwords and ensure that strong, unique passwords are used for remote management systems and connected devices.
Where remote access is operationally necessary, use secure remote access solutions, such as Virtual Private Networks (VPNs).
Review and restrict access to authorised personnel and trusted service providers only and ensure that external parties are granted access only to systems necessary for, and specific to their work.
Remove accounts that are no longer required.
Enable Multi Factor Authentication (MFA) wherever supported.
Allowlist the IPs and accounts that may reach controllers and management interfaces and block all other IPs and accounts.
Permit only required specific vendor or maintenance channels and block other outbound connections from the controllers.
c. Update and Secure OT Systems and Devices
Ensure that OT software, firmware and associated network devices are updated with the latest security patches and firmware provided by their respective vendors.
Review equipment that has reached end-of-life or is no longer supported by its manufacturer and implement appropriate compensating controls or replacement plans.
d. Implement Network Segmentation and Security Monitoring
Segregate OT networks from corporate IT networks and other non-essential systems to limit the potential impact of a compromise.
Monitor remote access activities and system configuration changes for suspicious behaviour, including unauthorised logins, unexpected changes to operational parameters and modifications to alarm or safety settings.
Implement robust logging and alerting mechanisms to facilitate the timely detection and investigation of suspicious activities.
e. Strengthen Operational Monitoring and Incident Response
Ensure that personnel can identify and respond to unexpected equipment behaviour, including unauthorised configuration changes or abnormal readings.
Develop and regularly review incident response and business continuity procedures, including the ability to safely isolate affected systems, revert to local or manual controls where supported, and maintain critical operations during a disruption.
Conduct regular training and exercises for staff to be familiar with the incident response procedures.
In the event of a suspected compromise, promptly alert relevant technical personnel and equipment vendors to investigate and contain the incident, as well as implement mitigation measures and business continuity procedures.
Report the incident to the relevant authorities in accordance with applicable obligations.
Perform post-incident reviews, document lessons learnt and strengthen cybersecurity controls to reduce the likelihood and impact of future incidents.
Conclusion
The recent cyberattacks against European supermarkets serve as a warning of how vulnerabilities in remotely accessible OT control systems can be exploited to disrupt physical operations, with potentially serious consequences for safety, continuity, and supply chains. Organisations across all industries that rely on internet-connected OT systems should proactively assess their cybersecurity posture and implement appropriate safeguards to reduce the risk of similar incidents.
References
https://cybersecuritynews.com/french-blood-plasma-freezers-hacked/ (opens in new tab)
https://www.cyber.gov.au/alert/protecting-operational-technology-and-edge-devices (opens in new tab)