Systems in the Netherlands were also affected by the incident. Shops were forced to empty fully stocked refrigerated display cabinets.
Naturally, everyone wants to know who was behind it. I understand that, but to be honest, I don’t think that’s the most important question.
The same thing happened in France last month. Afterwards, the advice was clear: disconnect these systems from the public internet. Yet, according to the manufacturer, the installations targeted last night were still using default passwords and were not connected to a secured network. No sophisticated hacking was required.
I suspect the problem isn’t really the technology, but rather who feels responsible for it. Refrigeration systems often fall between the cracks. IT sees them as a facilities issue, facilities sees them as the installer’s responsibility, and the installer originally connected them to the internet so they could monitor faults remotely. And that’s how they gradually slip off everyone’s radar.
Simply raising awareness is no longer enough, because we already knew this was a problem. What does help is taking a proper look at what is connected to the internet within your organisation, whether it really needs to be, and who is responsible for it.
I’m curious: do you know which devices in your organisation are currently exposed to the internet?
A simple question, but the answer is often surprising.