Overview
- The campaign began in mid-October and has since hit stores and some health‑care facilities in at least nine European countries and prompted investigations in the United States.
- Investigators say attackers remotely changed thermostat setpoints and triggered defrost or heating modes, with reported temperatures rising to about 50°C in some stores and isolated reports of much higher setpoints.
- Security probes now include national intelligence bodies such as Germany’s BfV and the GAZ Hybrid centre alongside police while attribution and motive remain unconfirmed and no ransom demands have been reported.
- Technical forensics point to internet‑exposed control devices, unpatched or obsolete software, default or unchanged passwords, and at least one case of access via an external maintenance provider.
- Authorities and agencies including the FBI, CISA and BSI urge operators to remove direct internet access, use firewalls and VPNs for maintenance, enforce strong authentication, and install updates as regulators plan tougher product rules by late 2027.