Singapore agency urges firms to secure internet-connected refrigeration and other OT systems after European attacks
The Cyber Security Agency of Singapore warned organisations to limit internet exposure of operational technology, citing recent cyberattacks on European supermarket fridges and blood-bank cold rooms.
Singapore's Cyber Security Agency (CSA) issued an advisory on Nov 6 urging organisations to restrict public-internet access to operational technology (OT) systems and to implement strong authentication. The warning follows a series of cyberattacks that compromised refrigeration controllers in supermarkets across Europe and, in France, cold-room systems at regional blood banks, forcing retailers to discard spoiled food and prompting emergency transfers of blood supplies.
CSA highlighted that poorly secured remote access to OT control systems can allow threat actors to manipulate physical processes and disrupt operations in various sectors. While no similar incidents have been reported in Singapore, CSA chief executive Gwenda Fong said organisations should assess which systems are internet-accessible, ensure remote-access arrangements are secured, and address any vulnerabilities promptly.
The agency advised firms to maintain an inventory of remotely managed OT devices, apply the latest security patches, and isolate legacy equipment that no longer receives vendor updates. A spokesperson for Sheng Siong confirmed the retailer uses non-internet-connected refrigeration, reducing its exposure. The Singapore Food Agency (SFA) reported no impact on the local food supply but is monitoring the situation and liaising with major retailers and cold-chain warehouses.
Cybersecurity experts noted that many internet-connected controllers still use default passwords or lack login mechanisms, allowing attackers to gain access through maintenance contractors. Aaron Ang, chief information security officer at Wissen International, warned that attackers could target ordinary, unprotected devices such as fridges, lifts or hotel chillers, and that Singapore's hot climate shortens the window to respond to cooling failures.
Industry specialists recommended checking with manufacturers for known flaws, disabling unnecessary internet access, and, where possible, isolating vulnerable equipment on separate networks. Sharing information about affected devices and vulnerabilities was urged to help operators across sectors mitigate risks more quickly.