Greece’s National Cybersecurity Authority has identified approximately 300 vulnerable devices used in commercial refrigeration systems following scans of Greek public internet addresses. The Authority had previously issued warnings about these security vulnerabilities and published relevant guidelines — however, its recommendations appear to have gone largely unheeded. Isolated reports of cyberattacks are now emerging in Greece as well, echoing similar incidents that have already struck businesses across Europe.
Speaking to Parapolitika, the head of the National Cybersecurity Authority, Michalis Bletsas, explained that the agency was mobilized following the first incidents in France, when it conducted a sweep of Greek public IP addresses to identify potentially vulnerable devices. “We found around 300 vulnerable devices across various refrigeration systems. We sent notifications, issued an announcement, and stated what needed to be done — but nobody paid attention,” he said pointedly, stressing that the responsibility for protecting these systems lies with the businesses that operate them.
A reassuring assessment
According to Bletsas, reports of cyberattacks in Greece remain isolated and are significantly smaller in scale than those recorded in other European countries.
He does clarify, however, that the Authority has not received an official report regarding the incident at a butcher shop that made the news. The absence of an official complaint does not mean that an attack did not occur, since the obligation to report incidents applies only to specific categories of businesses under current legislation.
Bletsas himself remains reassuring about the scope of these specific incidents in Greece, describing them as limited in severity compared to other cyber threats. That said, he acknowledges this does not eliminate the need for preventive action.
“Blind” attacks
Particularly noteworthy is Bletsas’s assessment of the attackers’ motives, prompted by the cyberattack on a refrigeration system used to store blood samples in France. In that case, the attackers attempted to change the temperature setting to 110 degrees Celsius, though the facility ultimately continued to operate without disruption.
According to Bletsas, these attacks are carried out essentially “blindly” — perpetrators scan the internet for vulnerable electronic controllers without necessarily knowing which business or facility they belong to. “When we scan the internet and find such devices, we don’t know what’s behind them,” he noted, suggesting that whoever attacked the French system likely had no idea it was serving a blood sample storage facility. In his view, the primary goal of these actors is not necessarily to cause extensive damage, but rather to create disruption. He also pointed out that hackers are increasingly exploiting security vulnerabilities that are now easier than ever to identify with the help of artificial intelligence.
Protecting refrigeration systems
The head of the National Cybersecurity Authority emphasizes that the Authority’s role is regulatory and advisory — providing information and guidance on addressing digital threats — without being able to directly implement technical fixes for vulnerabilities at individual businesses.
The risks posed by cyberattacks on refrigeration systems are further analyzed by retired Major General and former head of the Cybercrime Division Giorgos Papaprodromo, who warns that the consequences could extend well beyond any single business. “Any interruption or reduction in food preservation puts products at risk and could also jeopardize public health,” he cautioned. As he explained, the cold chain spans the entire journey of a product — from production and storage to transportation and sale.
Digital refrigeration systems are used in warehouses, food retailers, production facilities, and refrigerated transport vehicles. A cyberattack that disrupts their operation can therefore cause problems at any point along a product’s journey to the consumer.
Six key protective measures
Papaprodromo insists on the urgent need for concrete cybersecurity measures, stressing that businesses must treat cybersecurity as a fundamental prerequisite for their smooth operation.
In a concise guide published by the Pella Chamber of Commerce, authored by Papaprodromo and citing the National Cybersecurity Authority as its source, six specific steps are outlined for protecting commercial refrigeration systems.
These include: disconnecting refrigeration controllers from the public internet; using secure remote access via VPN and multi-factor authentication; replacing default factory passwords with strong, unique credentials; regularly installing security updates; replacing legacy devices no longer supported by their manufacturers; and promptly reporting suspicious incidents to cyber.gov.gr.
When asked whether Greece could face similar attacks, he replied: “No one can rule it out. We live in a connected environment, and any subsystem can be vulnerable at any time.” The key, he concluded, is for businesses to maintain constant readiness — not only to minimize the risk of a cyberattack, but also to restore normal operations as quickly as possible in the event of one.
Published in Parapolitika
