Hacker alert for HVAC&R – what you need to do

Europe has been experiencing a new wave of cyberattacks on refrigeration and freezer equipment in dozens of supermarkets, resulting in the loss of vast quantities of perishable food.

The first attacks in mid-October targeted supermarkets across France, exploiting a vulnerability in older control equipment for frozen food units. The culprits executed malicious code that sent the systems into a continual defrost cycle which resulted in temperatures rising to around 50^oC in some cases.

The result was spoiled food, and in some cases small fires.

• See our story here

This latest round of security breaches, which was reported on November 2, has hit multiple supermarkets across Belgium, Luxembourg, Sweden, Ireland, Estonia, Finland and the Netherlands.

The BBC reports that both refrigerators and freezers have been affected, with the main effect being the remote controls interfered with to send the equipment into defrost mode, which increases temperature rapidly.

It also states that most supermarkets in Europe are linked to the internet, as this enables remote maintenance and troubleshooting.

This is a risk that both European and Australian cyber security experts have been foreshadowing for some time.

EU Cyber Resilience Act

The EU introduced the Cyber Resilience Act (CRA) in 2024, with requirements becoming enforceable from December 2027. Ahead of enforcement, companies in the supply chain for smart products ranging from watches and baby monitors through to HVAC&R equipment are being urged to apply the relevant provisions.

• Read more about the act here.

According to the EU Commission website, the CRA introduces mandatory cybersecurity requirements for manufacturers that cover the planning, design, development and maintenance of all products that have digital elements and are enabled with connectivity to internet or other ICT networks.

The Commission stresses that the obligations apply across the value chain, including ongoing operations and maintenance, with manufacturers obligated to mitigate vulnerabilities during the life of the product.

It has published practical guidance to help manufacturers and businesses meet their obligations under the Cyber Resilience Act.

Europe-based manufacturer Carel, is also holding a free webinar on November 24 at 10am CET (8pm AEDT) to explain the requirements. The interactive webinar is open to anyone in the industry, find more details here.

Australian authorities issue alert

The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) recently released its seventh Annual Cyber Threat Report (ACTR). It shows that during the 2025-26 financial year, ASD’s ACSC received more than 82,000 cybercrime reports, averaging one report every six minutes.

This was an almost 80% increase on the previous year, they state.

“This year’s report highlights the growing impact of artificial intelligence (AI) on the cyber threat landscape,” the ACSC states.

“By enabling malicious cyber actors to operate with greater scale, speed and sophistication, AI is rendering cyber-attacks, scams and phishing attempts more efficient, effective and convincing.”

The report also incorporates guidance for businesses, individuals and critical infrastructure operators on how to strengthen defences against cyber security threats.

• Read the threat report here.

In October the ACSC also issued an alert in relation to internet-exposed equipment, following the first wave of European refrigeration equipment hacks.

The alert specifically addresses the cyber security risks to operational technology, including refrigeration and cooling technology, with mitigation advice and guidance for businesses and organisations that operate this technology.

“While ASD’s ACSC has not seen active targeting in Australia, businesses and organisations should remain vigilant,” the alert states.

“ASD’s ACSC strongly recommends that any Australian organisations and businesses that operate internet-connected operational technology (OT), including commercial refrigeration systems, assess their exposure to cyber security risks and follow ASD’s ACSC existing guidance on operational technology environments and securing edge devices.

“Insecure connectivity in OT and edge devices is known to be targeted by malicious actors to cause disruption and harm to critical services.”

The official mitigation advice

ASD’s ACSC advises Australian organisations to take the following steps:

• Ensure that OT environments and interfaces, and edge devices, are not directly exposed to the internet (particularly for older devices and systems, and those with remote access).
• Identify and patch any vulnerabilities promptly.
• Apply strong authentication, access controls, and network segmentation.
• Monitor systems for unusual automated activity and review security logs regularly.

Businesses should review and act on ASD’s ACSC existing guidance on operational technology environments, including guidance on securing edge devices and secure connectivity principles for operational technology.

Where to get help

Organisations that identify suspicious activity, attempted exploitation, or vulnerabilities affecting their systems, can contact ASD via 1300 CYBER1 (1300 292 371), or at www.cyber.gov.au/submit-a-report

Post content goes here

---