SINGAPORE: Organisations in Singapore have been urged to strengthen their cybersecurity defences following a series of overseas cyberattacks targeting operational technology (OT) systems, including refrigeration systems at hundreds of supermarkets across Europe.
While no similar incidents have been reported locally, organisations should not wait for an attack to occur before taking precautions, Commissioner of Cybersecurity and Cyber Security Agency of Singapore (CSA) chief executive Gwenda Fong said on Friday (Nov 6).
“They remind us that even sectors which may not traditionally consider themselves cyber targets can be vulnerable,” Ms Fong said.
“And the consequences can go beyond data loss — potentially disrupting business operations, supply chains and essential services.”
In an advisory on Friday, CSA said poorly secured remote access to OT systems could allow attackers to manipulate equipment settings, disrupt operations and pose safety risks.
The advisory cited recent attacks on refrigeration management systems at supermarkets across Europe, as well as an incident affecting refrigeration systems at facilities operated by France’s national blood service.
CSA said the incidents highlighted a broader threat involving internet-connected OT systems, which are used to monitor and control physical equipment and industrial processes.
Such systems are increasingly connected to the internet or corporate networks so that operators and third-party service providers can remotely monitor, manage and maintain equipment, potentially exposing other sectors to similar vulnerabilities.
Similar risks exist in sectors including energy and utilities, water treatment, manufacturing, building management, cold storage and logistics, and healthcare facilities, CSA said.
“While such connectivity offers significant operational benefits, poorly secured remote access can leave these systems vulnerable to potential compromise,” said CSA, adding that the European incidents reportedly involved poorly secured refrigeration controllers that were accessible over the internet.
In response to queries from CNA, CSA said it is working with the Singapore Food Agency and supermarket operators to strengthen cybersecurity measures of their networks and systems against cyber threats.
Potential security weaknesses included weak or default credentials, outdated software and insufficient access controls, although the precise methods used by attackers remain under investigation.
Once attackers gain unauthorised access, they may be able to change equipment settings, disable safety alarms or interfere with normal operations, potentially causing equipment damage, safety hazards, service disruptions and financial losses.
For industries dependent on cold-chain operations, disruptions to temperature controls could also compromise product safety and supply chains.