NEWS AND EVENTS
Why don't we learn from the same security weaknesses?
On 13 October, we spoke at the Attack conference and asked one question:
Do you actually know who has access to our water?
The question was about the digital systems that run our society, and how much control we really have over the technology we have come to depend on. It may sound dramatic, but the day before the conference we were reminded just how serious it is.
During the night of 12 October, at least 350 grocery stores in France were hit by an extensive cyberattack on their refrigeration and freezer systems. The attackers manipulated the temperature controls, and in some stores the temperature rose to around 50 degrees Celsius. Large quantities of food had to be thrown away, and fires were reported. In other words, a digital attack had very real, physical consequences.
Several of the affected facilities used control systems running outdated software, and some had reached the end of their supported life. In the aftermath, French cybersecurity authorities warned of the risk of exposing such control systems directly to the internet.
What is interesting about this incident is not how advanced or sophisticated the attack was, but that this is a known risk, and a pattern we have seen before. At the Attack conference, we highlighted several cyber incidents targeting water supply, both internationally and here in Norway, with the same pattern recurring across them.
Again, it was not particularly advanced attack methods that made these attacks possible. In several cases, it came down to far more basic issues such as weak passwords, inadequate access control, insufficiently secured remote access and industrial control systems exposed to the internet. In other words, fundamental security mechanisms that were either missing or not adequately implemented.
Following the attack in France, British security researchers identified more than 800 refrigeration and building management controllers with administration interfaces exposed to the internet. Several of the systems were connected through solutions set up for remote servicing. Investigations also showed that thousands of Danfoss interfaces were visible on the internet globally. A system being reachable from the internet does not automatically mean it is vulnerable or compromised, and we do not yet know exactly how the attackers gained access to the French refrigeration systems.
But the findings illustrate a well-known challenge: technology that controls physical processes can be reachable from the outside without the organization necessarily having sufficient oversight of that access and the risk it represents. We are not talking about unknown security principles or challenges that have only emerged with artificial intelligence and increasingly advanced cyber threats, but about basic security measures we have known about for many years.
Industrial control systems have traditionally been relatively isolated, but as digitalization has progressed they have become ever more closely connected to other networks. Remote control, automation and access for external suppliers bring major efficiency gains, while also creating new dependencies and new entry points for potential attackers. Many of these systems were developed at a time when cybersecurity was not as central to design. They can have a lifespan of several decades, and it is not always easy to update or change them without affecting operations. The challenge is rarely a lack of security measures or documentation; the challenge is not always knowing what you are actually trying to protect. After all, how can we protect systems we have no overview of? And how can we detect an attack if we do not know what normal activity looks like?
Through our work with OT security in Norwegian industry and critical infrastructure, we see how demanding it can be to establish a complete overview of these environments. Legacy systems still in operation, networks that have evolved over many years, external suppliers who need remote access, or equipment and communication links that are not necessarily part of the organization's regular security monitoring. Together, these can create a risk picture that is difficult to understand and control.
An organization may have invested heavily in cybersecurity, established good routines and have good control of its traditional IT environment. But does that mean it also has control of the control systems in production? Of the water pumps? Of the refrigeration systems? Of its suppliers' remote access?
We may believe we are in control because we have security systems in place, without having sufficient insight into the systems that actually run physical operations. In an OT environment, it is also not enough to know that someone has gained unauthorized access. We need to understand what that access can be used for, and what consequences the manipulation of a physical process can have. A command that is in itself a completely legitimate part of operations can have serious consequences if it is carried out by the wrong person, at the wrong time or with the wrong intent.
An attack on a refrigeration system can lead to spoiled food and financial losses. An attack on a waterworks can affect the water supply. An attack on an industrial production facility can halt production or, in the worst case, create dangerous situations. The common denominator is that digital attacks can have consequences far beyond the digital world.
In many organizations, responsibility for operational technology is divided among several parties. The IT department is responsible for information security, the operations department is responsible for production, and external suppliers install, operate and maintain the equipment. We often see a challenge in who holds the overall risk picture. Who knows which systems are reachable from the outside? Who has an overview of suppliers' access? And who is responsible for making sure that unwanted activity is actually detected?
These are questions that should be high on the agenda of the management team and the board. The board and top management will not be in a position to understand every technical detail, but they should be able to understand what consequences a lack of control can have for the organization.
Today we talk a lot about artificial intelligence, autonomous cyberattacks and a threat landscape that is evolving ever faster. These are important discussions, but we must not lose sight of the basics. What good is preparing for tomorrow's advanced threats if we still have systems reachable from the internet without adequate protection? What good is investing in advanced security technology if we do not know which devices are on the network, who has access to them, or whether we would detect unwanted changes?
We must of course continue to develop our security work in step with the threat landscape, while also making sure the basic mechanisms are actually in place. That starts with an overview of your own systems and communication links, control of access and remote access, clear responsibility, necessary security updates and the ability to detect activity that deviates from normal.
When we see the same basic security weaknesses recurring across industries and national borders, it is time to stop treating each incident as a surprise.
Sources:
Reuters, 13 October – Scope, affected systems, outdated updates and the investigation.
Cooling Post, 14 October – ANSSI's warning and information about further affected control systems.
UK Cyber Defence, 12 October – The mapping of more than 800 internet-exposed controllers.
Le Monde, 13 October – Reporting on the manipulation of defrost cycles and the consequences in the stores.
Insights from Norway’s cybersecurity experts
My first Attack conference: Golf, good conversations and a more serious backdrop
How do you present a cybersecurity company to potential customers while you are still learning about it yourself? I got to practise that when I attended my very first conference, the Attack conference, with SecureNOK on 13 October.
SNOK Health Check picks up speed – we are delivering OT overview after OT overview
What equipment is connected to the OT network, and who is communicating with whom? After several projects with the SNOK Health Check, I see how useful it is to get answers to these questions before deciding on the next security measure.
Water supply and critical infrastructure in focus at the Homeland Security Conference in Denmark
What does it take to keep society running when critical infrastructure is exposed to attacks and disruptions? This question was central when I attended the Homeland Security Conference in Copenhagen on 7 October with the Norwegian Cybersecurity Cluster.
Halfway through the OT Roadshow – time for the conversations that often have to wait
Trondheim, Bergen and Stavanger are done, and we are halfway through the OT Roadshow. For me, this is a valuable opportunity to look up from technology development and discuss security with those who know the everyday reality of industry.
Full house as IVAR IKS shared its experiences with OT security
Interest in the webinar with IVAR IKS was greater than we had dared to hope. Through our October campaign on health checks for water and wastewater facilities, we are now making it easier for more organizations to take the same first step towards better overview and control of their OT environments.
ON 104 has been updated: New requirements for safer and more robust operations on the Norwegian continental shelf
From 1 June 2026, the updated version of Offshore Norge Guideline 104 (ON 104 Rev. 7) applies – one of the most important frameworks for cybersecurity in operational technology (OT) in the petroleum industry.
The Norwegian Food Safety Authority's new guide makes one thing clear: Waterworks must now take OT security seriously
The Norwegian Food Safety Authority (Mattilsynet) has now published the first official guide to the Digital Security Regulations for drinking water. It is an important milestone for Norwegian water supply – and a clear signal that the authorities are now stepping up work on digital security in the sector.
OT Konferansen shows the Nordics taking a leading role in OT security
Today, many industrial environments consist of industrial networks, virtual environments, Windows and Linux systems, remote access, patching and backup solutions, security tools, cloud services and integrations with IT.
OT security in the food industry starts with insight
As a project manager on OT security projects, I often encounter the same starting point at industrial companies: They know a great deal about production, processes and equipment – but far less about what the digital infrastructure actually looks like in practice.
Norwegian-developed OT security technology for industry and critical infrastructure
Norwegian industry is becoming increasingly digitalized. Production lines, process plants, energy systems and critical infrastructure are being connected more closely to modern IT systems, external suppliers and digital services. At the same time, there is a growing need for cybersecurity solutions actually developed for industrial environments.
Strong support for OT Konferansen 2026 – bringing together leading experts in Stavanger
OT Konferansen 2026 takes place on 29 April in Stavanger, and this year's edition already stands out with a programme that brings together some of the most central players in OT security and industrial digitalization.
Growing need for control in complex automation environments in oil and gas
In recent years, the digitalization of the oil and gas industry has brought significant gains in efficiency, better data and greater flexibility. At the same time, this development has led to a significant increase in complexity – and therefore also in risk.
How to gain control of the OT environment in practice – experiences from IVAR
For IVAR IKS, stable operations are not just a goal – they are a prerequisite for society to function. As a provider of water and wastewater services to around 360,000 residents in Nord-Jæren, the organization manages critical infrastructure where the consequences of failure are immediate and extensive.
The Preparedness Year 2026: Are water and wastewater in Norwegian municipalities secure enough?
Municipal water supply is among the societal functions covered by the Digital Security Act. The Act entered into force on 1 October 2025 and sets basic requirements for digital security in organizations of particular importance to society. The regulations also place responsibility for digital security clearly with the organization's top management.
Stricter Security Requirements for Critical Services from 1 October 2025 under theDigital Security Act
O nFriday, 20 June, the Norwegian government decided in a Council of State meeting that the Digital Security Act will enter into force on 1 October 2025. At the same time, the Digital Security Regulation was adopted, entering into force concurrently with the Act.
Bremanger Breach: Lessons from a Norwegian Dam Hack
Earlier this year, unidentified hackers breached the control system of a Norwegian dam at Risevatnet, in Bremanger. The hackers discovered that the dam had a Human Machine Interface (HMI) exposed on the Internet and was able to gain access by exploiting a weak password.p
Digitalization: Opportunities and New Risks
Digitalization offers enormous opportunities for efficiency, but it also introduces new risks. When OT systems (Operational Technology) are connected to the internet, vulnerability to attacks increases—attacks that threaten not only data, but also lives, health, and critical societal functions.