Exposed industrial controllers targeted by cyberattacks – HEAK recommends immediate disconnection from the public internet

The National Cyber Security Authority (NCSA) strongly urges critical infrastructure operators to sever external internet connections for all equipment control systems following recent, high-impact security incidents in Europe. These events highlight a systemic vulnerability stemming from exposed industrial controllers running outdated software and lacking proper defenses. Specific examples include Dutch researchers identifying over 8,500 potentially accessible wind and photovoltaic systems across multiple nations, alongside French attackers manipulating supermarket cooling units to cause spoilage and fires. The NCSA is actively monitoring over 300 similar vulnerable commercial refrigeration setups in Greece.
The authority recommends immediate mitigation steps for all affected entities: isolating control systems from public networks (using only VPNs with MFA for necessary remote access), updating software, and replacing unsupported hardware. The warning emphasizes that even unpatched, known flaws can result in physical damage quickly, an acceleration exacerbated by emerging AI capabilities. Furthermore, entities subject to Law 5160/2024 must adhere to strict incident reporting timelines with the NCSA.

NCSA calls on critical infrastructure operators to disconnect equipment control systems from the public internet.
Two serious incidents occurred in Europe: one involving exposed wind and photovoltaic park systems found by Dutch researchers (8,547 systems across 35 countries, attack possible on 181).
A second incident involved attackers gaining control of cooling systems in approximately 700 French supermarkets, causing temperature spikes up to 50°C.
The root cause for both incidents was identified as exposed industrial controllers on the internet.
Siemens S7 controllers have been subject to prior NCSA warnings since August regarding similar access risks.
NCSA currently identifies over 300 similar exposed systems in Greece, primarily commercial refrigeration controllers (Danfoss, Copeland/Dixell, Carel).
The recommended actions include disconnecting control systems or restricting remote access via VPN and multi-factor authentication.
Entities under Law 5160/2024 must report significant incidents within 24 hours to specific NCSA channels.

Steelmanning the narrative, the core argument—backed by tangible European events—is a stark call for fundamental operational security hygiene at scale. The premise, credibly established by citing documented attacks in France and surveys in the Netherlands, is that legacy industrial control systems represent an unacceptable single point of failure capable of translating digital exploits into kinetic physical harm (fires, spoiled goods). This effectively argues that the risk profile has escalated from data theft to existential threat against physical assets.
The pattern here involves 'Urgency Amplification through Specificity.' By detailing specific outcomes—50°C in a supermarket, mass exposure across 35 countries—the urgency moves beyond abstract security concepts into relatable consequences for societal function (food supply, infrastructure integrity). This framing necessitates immediate compliance rather than long-term strategic investment. The assumption underpinning this mandate is that the operational inertia of critical infrastructure cannot be overcome without top-down regulatory compulsion and expert warnings.
Implications suggest a significant shift in the economic calculus for industrial operators; maintaining outdated systems becomes not just an IT risk, but a demonstrable threat to social resilience, potentially forcing premature and costly hardware replacement cycles dictated by national security imperatives. The primary beneficiary of this posture is codified governmental oversight, strengthening its regulatory reach into previously decentralized operational environments.
How must industry leaders differentiate between necessary modernization efforts and reactive compliance driven by fear? At what point does the cost of mandatory 'air-gapping' outweigh the documented probability of attack for critical services that *must* remain partially connected? If current vulnerabilities are based on old software, how can organizations responsibly manage the risk associated with patching systems that manufacturers have already abandoned?
The playbook an influence campaign might use would involve maximizing fragmentation: using disparate, high-profile incidents (France fires vs. Greek inventory loss) to obscure a unified vulnerability pathway and demanding immediate compliance via regulatory fear. The current content strongly matches this by deploying discrete case studies alongside the direct invocation of impending legal deadlines (NIS2), successfully framing the issue as an urgent, unavoidable compliance requirement rather than a negotiable security challenge.