Cool rooms, alarms and CCTV can expose your business to attackers. Here's what to check and how to secure the equipment nobody thinks of as IT.
There's a good chance the cool room, the alarm panel or the air conditioning in your building can be reached from the internet, and nobody has checked in years.
Overnight on 11th of October, attackers remotely took control of refrigeration systems in supermarkets across France and forced them into a defrost cycle. The French Government said around 700 stores were affected, and some had to throw out stock. Nobody broke a window. They logged in to equipment that was sitting on the internet.
This isn't really a story about fridges. It's about all the equipment in your business that has a login and nobody thinks of as IT.
Why a fridge can be reached from the internet
Modern refrigeration, air conditioning, alarm systems and CCTV recorders all have a small computer inside them, usually called a controller, with its own web page and login. That's what lets your refrigeration contractor adjust a set point from their van instead of driving out at 9pm.
The quickest way to set that up is to make the controller reachable from the internet, leave the login the installer created, and move on to the next job. Then nobody touches it again. Researchers had published flaws in the affected controllers in August and fixes were available, but the morning after the attack, one researcher still counted more than 2,700 of them exposed online.
A few signs this applies to your business:
- Your contractor can change settings without coming on site. Convenient, and it means the device can be reached from outside somehow.
- The CCTV app works on your phone from anywhere. Same principle – the recorder is reachable, and the question is how.
- Nobody in the business knows the login. It was set by the installer and lives in their records, or on a sticker on the unit.
- The device has never had an update. Firmware on this kind of equipment rarely updates itself, so most of it is running whatever it shipped with.
What it costs when it goes wrong
These devices don't hold your financial records, so it's easy to assume there's not much to lose. The losses just look different.
- ▶️ Stock you can't use. A temperature breach overnight means discarded product, food safety records to complete and a day spent on cleanup instead of trading.
- ▶️ Vaccines and medications. For a clinic or pharmacy, a cold chain breach usually means isolating the stock and reporting it before any of it can be used, which can mean patients rebooked and doses replaced.
- ▶️ A way into everything else. A controller on the same network as your office PCs gives an attacker a foothold that no antivirus is watching.
- ▶️ Harder questions from your insurer. Cyber insurance applications increasingly ask about remote access and how your network is separated, and equipment nobody knew was exposed can complicate a claim.
- ▶️ Footage you no longer control. CCTV that shows identifiable customers or patients is personal information, and for health providers an exposed recorder could become a matter for the Notifiable Data Breaches scheme.
What to check this month
None of this needs new equipment. It needs a list and a few conversations.
- ✅ Walk the building and list everything with a network cable that isn't a computer. Cool room and freezer controllers, air conditioning, alarm panels, CCTV recorders, door access, meeting room screens. Thirty minutes for most offices.
- ✅ Ask each contractor exactly how they connect remotely. A good answer is a secure remote access tool or VPN that you can switch off. A worrying answer is "it's just on the internet" or "we had a port opened on your router".
- ✅ Replace default logins and record who holds them. Each device gets its own password, stored in the business's password manager rather than only in the contractor's files.
- ✅ Put this equipment on its own network. A separate network segment, often called a VLAN, keeps a compromised fridge controller away from the accounts team's computers. Your IT provider can usually set this up on existing hardware.
- ✅ Make firmware updates part of the service contract. Ask who is responsible for updating the device, and how you'll know it's been done.
If you want help securing the devices connected to your network, get in touch.
- cyber security
- connected equipment
- remote access
