Internet-exposed refrigeration controls turned a nuisance hack into a medicine risk

A European wave of attacks on refrigeration systems has crossed from retail into healthcare. Germany’s federal cybersecurity agency told CORRECTIV that a pharmaceutical distributor’s medicine-cooling systems were attacked. In France, a blood service detected an intrusion affecting three facilities operated by a contractor; it said products remained safe.

The common weakness is mundane. Some refrigeration controllers contain small web servers for remote monitoring and configuration. Older units were placed directly on the public internet without a firewall or adequate access controls, despite a manufacturer warning about vulnerabilities in 2022. Attackers could therefore find exposed devices at scale and change operating temperatures. At one Bavarian Edeka shop, a unit was reportedly switched overnight to a setting labelled “heat to 50 degrees.”

That turns a cheap intrusion into a physical-integrity problem. Food, medicines and blood products depend on documented temperature ranges; a manipulated controller can spoil inventory or force its disposal even when no corporate network is breached. Central remote management increases efficiency but also lets the same weak interface reach multiple cabinets or sites. AI may lower the skill needed to discover and operate these systems, according to the BSI, but the vulnerability is the internet exposure itself rather than any novel AI exploit.

Pro-Russian Telegram channels claimed the recent incidents for Russian hacktivist groups. The BSI says it has seen the posts but has no evidence supporting that attribution and considers the attacks untargeted and opportunistic: attackers appear to scan for vulnerable systems without necessarily knowing the company or sector behind each device. Security officials therefore suspect that some political claims may be opportunistic appropriation of someone else’s work.

The defensive lesson is broader than refrigeration. Operational technology that controls a physical process should not inherit the exposure assumptions of an ordinary website. Inventorying controllers, removing direct internet access, segmenting them from business networks, enforcing strong remote authentication and alerting on implausible set-point changes are more important than assigning geopolitical motive. Until those basics are applied, an indiscriminate scan can accidentally reach a critical cold chain.