Germany's Federal Office for Information Security, known as the BSI, published guidance Tuesday urging operators of small industrial installations, from food refrigeration to power generation and water treatment, to protect control devices that can be reached from the internet. The recommendation came a day after France's cyber agency first warned of attacks on refrigeration controllers at French supermarkets. The BSI stressed that it recommends the measures independently of the French incidents, German tech news site heise online reported, though its president warned that the attack could find imitators. It extends the lesson from France to a large group of businesses that no cybersecurity regulator oversees.

The French attack forced chains to throw out chilled food, and France has since widened its alert to more controller brands.

What Happened

The BSI released the document, titled "Gefährdung durch internet-verbundene OT-Systeme" ("Threats From Internet-Connected OT Systems"), through its Alliance for Cyber Security. Operational technology, or OT, means the computers that run physical equipment such as compressors, pumps and turbines. The BSI's page says the guidance is aimed mainly at operators of small industrial or comparable installations that use industrial control devices, naming food refrigeration, electricity generation and water treatment as examples. The page itself does not mention France.

RelatedCISA Orders Agencies to Fix Exploited Palo Alto Firewall and Cisco Email Gateway Flaws by Saturday

heise reported that the agency's examples include networked solar inverters, cooling systems, individual wind turbines and drinking-water supply points. Such sites generally face no special IT security rules unless they are classed as critical infrastructure. The BSI's main advice, according to heise, is to separate these systems from the internet, which it calls the most important and simplest step. Where remote access is needed, operators should use encrypted VPN connections, sign-ins protected by a second factor, allowlists that limit who may connect, and prompt software updates. The agency also points operators to tools that show whether their controllers are visible online.

heise quoted BSI President Claudia Plattner as saying the French attack could have hit any country and could find imitators at any time. A BSI spokesperson told heise that, based on current knowledge, the controllers' passwords had apparently been poorly protected when the devices were delivered.

The German Food Retail Association told heise it knew of no affected stores in Germany.

Why It Matters

The guidance is aimed at owners who often do not think of themselves as security targets: a supermarket's refrigeration contractor, the owner of a single wind turbine, a drinking-water supply point. These are the businesses the French attack showed to be exposed. France's computer emergency response team, CERT-FR, says in its alert that attack campaigns against Danfoss, Copeland and Dixell refrigeration controllers are probably still under way, and that end-of-life equipment left exposed online is very likely to be compromised.

For executives, the practical question is who can reach the controllers running their sites and through which connection. Refrigeration controllers in particular are often serviced remotely by contractors. Taking them offline or behind a VPN can break those service arrangements, which is why CERT-FR tells operators to check their insurance terms before cutting a contractor's data link.

The BSI spokesperson's remark points to a liability shift that has not yet arrived. The spokesperson told heise the weak default passwords should ideally have been caught in a conformity check under the EU Cyber Resilience Act, but the law's stricter duties for makers of networked devices apply only from December 2027. Until then, and for equipment already installed, the burden stays with operators.

What to Watch

Watch whether other national agencies, including the Cybersecurity and Infrastructure Security Agency in the U.S., publish similar guidance for small operators, and whether French investigators say who carried out the attack and how the controllers were reached. Reports of copycat attacks outside France would test Plattner's warning.