DDoS attacks leave Finland housing without heating

Heating systems are the latest victims of distributed-denial-of-service (DDoS) attacks, according to reports in Finland.

Finnish news website Etela-Saimma reported that a targeted attack on a building management system of two residential premises in Lappeenranta left occupants without heating and hot water, at a time when temperatures were below freezing.

The buildings are managed by property management company Valtia, whose internet connection was taken offline by the attack - leaving it unable to supply heating into the building.

Most energy providers do not need an internet connection in order to be able to provide heating or hot water, and this led to many Finnish citizens asking why Valtia had to be connected to the internet in the first place.

The firm explained on its website that the internet connection enables it to monitor and adjust systems remotely, including temperature and ventilation controls. It said this brings savings in costs and considerably speeds up the company's processes.

The connection also allows the system to alert the company if the heating isn't working or if the radiator pressure disappears.

It said that in those cases where an internet connection isn't enabled "damage will increase, repair time will increase and costs will rise".

Simo Rounela, CEO of Valtia, said that the attack started at 12pm on Tuesday, 1 November, and ended on Thursday afternoon.

He told Finnish news website Helsingin Sanomat that the attack was thwarted by installing a firewall to limit network traffic. The system manufacturer Fidelex told Metropolitan.fi, another Finnish news outlet, that it was seeing similar attacks around Finland because housing companies or private owners don't want to invest in network security.

DDoS attacks have been increasing and have become more sophisticated year-on-year. As the number of devices connected to the internet is growing with the Internet of Things (IoT), it is likely that all kinds of systems will be targeted and taken offline.