Cyberattacks on the cold chain: two Italian companies hit, ACN issues alert

Two Italian companies have been targeted by cyber-attacks on their cold-chain systems. A Tuscan company operating in the catering sector has already reported the incident to the National Cybersecurity Agency under the NIS regulations, whilst a second attack has been detected against a company in Emilia that produces frozen foods; this has not yet been reported.

The two Italian cases form part of a series of attacks targeting refrigeration and food distribution operators in various European countries, including Belgium, Luxembourg, Ireland, the Netherlands, Latvia, Finland and Sweden. Similar incidents had already affected a number of French supermarket chains.

For this reason, the ACN has stepped up monitoring across the country and drawn the attention of operators in the large-scale retail sector, the food logistics sector, the industrial refrigeration sector and maintenance companies. The aim is to identify any new cases quickly and reduce exposure in the systems used to monitor facilities and temperatures.

The main recommendation is to urgently check whether control and remote support systems are directly exposed to the internet and, if so, to isolate them in secure environments separate from corporate networks. The Agency also calls for remote access to be secured through VPNs and multi-factor authentication, for accounts with elevated privileges to be monitored, and for devices that are no longer supported by their manufacturers to be updated or replaced.

The level of vigilance remains high, not least because of the widespread presence of businesses involved in the food supply chain. The ACN has called a meeting for tomorrow with the sectoral federations and the leading national retail chains, making its facilities available to strengthen businesses’ ability to defend themselves and, where necessary, to speed up the adoption of prevention and mitigation measures.