Following cyberattacks detected in Europe and Latvia targeting remotely controlled refrigeration equipment, the Crisis Management Centre (CMC) urges ministries and municipalities to pay attention to the cybersecurity of other remotely controlled devices and engineering systems. Guidelines containing practical recommendations have been sent to institutions, encouraging them to identify such equipment within a week, assess its protection measures, and implement security improvements where necessary.
Remotely controlled equipment is used in many sectors essential to residents' daily lives. Such systems support heating, water supply and wastewater services, energy infrastructure operations, the storage of food and medicines, as well as building maintenance systems in schools, hospitals, and other institutions. Cybersecurity threats affecting these systems may cause not only disruptions to information systems but also directly impact technological processes, the storage of material resources, and the continuity of essential services.
The Crisis Management Centre recommends taking the following preventive steps:
identify remotely controlled equipment, its locations, and responsible maintenance providers;
verify that equipment control panels are not directly accessible from the internet;
replace manufacturer default passwords and review user access rights;
ensure secure remote access through a VPN or another closed, encrypted connection, strong passwords, and two-factor authentication;
separate industrial control systems from the organisation’s general computer network;
review security updates, system monitoring arrangements, and cyber incident response procedures.
Attention should be paid to these recommendations by private operators, municipal enterprises, and equipment maintenance companies that have remote access to such systems. Ministries and municipalities are encouraged to inform these stakeholders about the threat.
If unauthorised access to remotely controlled equipment or its control systems is detected, institutions should immediately contain the incident, ensure continuity of services, and preserve all relevant evidence. Incidents should be reported to the national cyber incident response institution CERT.LV by calling +371 67085888 or by using the contact details available at cert.lv.
Through its regular scanning of Latvia’s cyberspace, CERT.LV has already identified insecure internet-facing industrial control systems this year and, by providing timely warnings to their owners, has helped prevent more than 300 security risks related to various industrial control systems that could potentially have resulted in serious consequences.
The guidelines have been prepared by the Crisis Management Centre as part of its responsibilities under the National Security Law, including risk and threat monitoring, support to ministries and municipalities in planning and preparing crisis management measures, and coordination of sectoral business continuity planning. The guidelines are intended as recommendations and do not replace cybersecurity requirements established in legislation or the competencies of CERT.LV and sector regulators.
Cyberattacks against refrigeration systems have been observed across Europe since October 2026. In these incidents, attackers remotely altered temperature settings, causing food products to become unfit for consumption and requiring their destruction. Such incidents have been reported in at least eight European countries, including Estonia and Finland.