Exposed industrial controllers targeted by cyberattacks – HEAK recommends immediate disconnection from the public internet

The National Cyber Security Authority (NCSA) calls on critical infrastructure operators to immediately disconnect any equipment control systems from the public internet. This recommendation follows two recent serious incidents in Europe. On October 6, Dutch researchers announced that they found 8,547 exposed wind and photovoltaic park systems across 35 countries. In about 181 of these, an attacker could gain full control. Five days later, in France, attackers gained control of cooling systems in approximately 700 supermarkets, raising temperatures up to 50°C, resulting in spoiled food and fires in some stores. Both incidents share the same root cause (exposed industrial controllers on the internet) as the targeting of Siemens S7 controllers, which the NCSA had already warned about since August. These are devices accessible via the internet, running old software, and lacking adequate protection. In Greece, the NCSA currently identifies over 300 similar exposed systems, mainly commercial refrigeration controllers (Danfoss, Copeland/Dixell, Carel), and is directly notifying the managing entities where possible under data protection regulations. In every case, the NCSA recommends: - Disconnecting control systems from the public internet and allowing remote access only via a secure connection (VPN) and multi-factor authentication. - Changing default passwords and installing security updates. - Replacing equipment that is no longer supported by the manufacturer. "What we find, an attacker can also find. France showed that a known but unpatched vulnerability can cause physical damage overnight," emphasizes the Director of the NCSA, Michalis Bletsas. The acceleration brought by artificial intelligence makes applying basic cybersecurity hygiene rules an absolute priority for societal resilience. Entities falling under Law 5160/2024 (NIS2) must report any significant incident within 24 hours to: https://cyber.gov.gr/kyvernoepitheseis/anafora-symvanton/ incident[@]cyber.gov.gr