Supermarket refrigeration typically combines local controllers, which regulate individual cabinets and plant, with a supervisory system for central monitoring and configuration. This may operate independently or exchange information with the wider BMS.

A refrigeration supervisor can give engineers access to temperatures, schedules and alarms across multiple units. If attackers obtain sufficient permissions, they can misuse those same functions. The key weaknesses highlighted by the incidents and related security research were:

• Internet-exposed management interfaces, allowing outsiders to reach equipment intended for authorised maintenance
• Weak access protection, including unchanged default credentials
• Outdated or unsupported firmware, potentially leaving known security defects unresolved
• Extensive supervisory permissions, allowing one compromised interface to affect multiple cabinets

As early as August, Claroty researchers documented vulnerabilities in refrigeration controller platforms, including an authentication bypass. The precise entry method used in every affected supermarket has not yet been publicly confirmed.

Once access was obtained, changing operating settings could disrupt cooling without physically damaging the refrigeration equipment.

Yes, where an installation has comparable weaknesses. A BMS may monitor or control various HVAC services, including boilers, heat pumps, chillers, pumps and ventilation equipment. Its authority varies: some connections provide information only, while others allow changes to setpoints, schedules and plant commands.

An attacker with sufficient access could therefore interfere with environmental conditions or equipment operation. This makes the configuration of each installation more relevant than a general assumption that all connected buildings face identical risks.

The US-based National Institute of Standards and Technology (NIST) identifies increased cybersecurity exposure as building automation systems become integrated with corporate networks and cloud services.

Depending on permissions and system design, unauthorised changes could disable heating during occupied hours, reduce ventilation, alter pump sequencing or keep equipment running overnight. The consequences range from discomfort and wasted energy to disruption of temperature-sensitive processes. In healthcare facilities and laboratories, airflow and pressure relationships may also require particular protection.

Alarm thresholds or notification settings could potentially be changed, delaying detection. For critical conditions, independent monitoring may therefore provide an additional safeguard. However, access to a BMS does not automatically allow someone to bypass hardwired safety interlocks, motor protection or independent equipment controls. A review should establish which safeguards remain effective if supervisory control is compromised.

No. Remote monitoring and diagnostics can improve maintenance response, reduce unnecessary visits and help engineers identify deteriorating performance. The question is how access is provided and managed.

Controllers should not be directly exposed to the public internet. Remote connections should use controlled gateways, strong authentication and permissions matched to the user’s role. Individual accounts make activity easier to trace and access easier to withdraw.

National Cyber Security Centre (NCSC) guidance recommends centralising and standardising remote connections so security controls and monitoring can be applied consistently. Undocumented routes installed for different contractors are harder to oversee.

Changing the mobile connection alone does not resolve controller vulnerabilities. Cellular routers can provide maintenance access separately from a building’s main network. If poorly configured, that route may sit outside the organisation’s usual IT oversight.

The important factors are whether incoming access is restricted, users are authenticated, equipment is supported, and activity is monitored. A newer modem does not correct outdated controller firmware or remove default passwords. Facilities teams should therefore include contractor-installed cellular connections in their network records and access reviews.

A BMS can only make reliable decisions when it receives accurate data. Faulty, poorly positioned or incorrectly calibrated sensors can cause the system to respond to conditions that do not exist. An inaccurate outside-air sensor may initiate the wrong seasonal mode. A room sensor exposed to direct sunlight can create an unnecessary cooling demand, while one positioned close to heat-producing equipment may suppress heating in an otherwise cold space. The reading shown on the BMS should be compared with an independent measurement.

Engineers should also consider whether the sensor’s location accurately represents the area it controls. A functioning sensor in the wrong position can still produce poor building performance.

Age alone is insufficient grounds for replacement. Start by establishing manufacturer support status, available firmware updates, network exposure and operational importance. Firmware is the embedded software running a controller, and when updates are missed, systems can be left exposed to unresolved defects. Once support ends for outdated firmware, further fixes may be unavailable.

While some installations can be improved through supported updates and better access controls, others may need phased controller replacement or additional network protection while upgrades are planned. Updates should follow manufacturer guidance, with compatibility checks, backups and an agreed maintenance window. NCSC guidance also emphasises replacing obsolete boundary equipment and maintaining tested recovery arrangements

Bring the facilities team, BMS contractor and IT specialists together to establish:

• What is connected: controllers, supervisory software, gateways and remote routers
• Who has access: current users, shared accounts and former contractors
• What remains supported: software versions, firmware and replacement priorities
• What happens during disruption: local operation, alarm availability, isolation and recovery

Include the consequences of losing remote connectivity. Restricting a connection might also interrupt alarm delivery or maintenance support, so isolation procedures should be planned and tested.

The building owner or operator should assign clear responsibilities across facilities management, IT and the relevant contractors. Agreements need to identify who authorises access, applies updates, maintains records and responds to suspicious changes.

Responsibilities should be established during design and carried through installation, commissioning and ongoing maintenance. For facilities managers, the following provides a practical framework for discussions with building-services contractors and IT teams.