The FBI, CISA and three other US agencies have warned of ongoing attacks on industrial refrigeration systems, urging organizations to act quickly to secure devices.
In an advisory published Nov. 5, CISA, the FBI, HHS, USDA and DOT said attackers are targeting temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities.
Attackers are looking for unpatched internet-connected devices using authentication bypass, code injection or simply exploiting weak configuration in order to take control.
They are then programming them into continuous cycles of heating up and defrosting, destroying frozen inventory and causing potential fire risks.
“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity, in a statement.
The warning follows two waves of attacks on supermarket freezers in Europe. In October, France’s CERT-FR warned of attacks on remote management units made by Danfoss, Copeland and Dixell, and this month the attacks spread to seven European countries.
The systems affected are widely used in the healthcare, chemical, food and agriculture, and transportation sectors.
“We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk,” said Brett Leatherman, the FBI’s cyber branch operations director.
The agencies did not attribute the activity to any specific threat groups.
Block internet access and patch now
The agencies urged operators to take controllers off the public internet, protect any remote access they still need with an up-to-date firewall or edge device, and separate OT devices from business networks.
They also advised changing default passwords, using phishing-resistant MFA where feasible, keeping firmware updated and replacing end-of-life devices the vendor no longer supports. Operators should set safe temperature limits with alerts for any deviation, and keep tested offline backups.
Samuel Hassine, CEO and co-founder of French security company Filigran, said the lesson reaches well beyond retail. “Every business runs equipment it does not think of as IT: cooling, heating, door access, building controls. Find what is connected, take it off the open internet, and fix it with the manufacturer. Attackers look for what you forgot you own.”
The US Department of Defense is also investigating suspected hacks of freezers on military bases, TechCrunch reported, citing Reuters.
Nextgov/FCW reported that the incidents began around late August, affected roughly six commissaries, and that US officials suspect Iran-linked hackers.
Officials have not publicly confirmed either report.
