US agencies warn attackers are targeting refrigeration systems that protect food and medicine
Threat actors are going after the controllers that keep grocery store freezers and cold storage rooms at safe temperatures, and they may push those units into continuous heating and defrost cycles, five US federal agencies warned in a joint advisory published on Thursday.
CISA, the FBI, the Department of Health and Human Services (HHS), the US Department of Agriculture (USDA) and the Department of Transportation (DOT) issued the warning in response to ongoing malicious activity aimed at industrial refrigeration and cold chain monitoring systems globally.
Organizations in healthcare and public health, chemical, food and agriculture, and transportation rely on these systems, refrigerated transport included, to monitor and log temperatures, manage defrost cycles and keep energy use in check.
“In close collaboration with our government, industry and international partners, CISA is actively tracking this threat activity,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity. “Every organization that depends on refrigeration and monitoring systems should assume it could be a target.”
Brett Leatherman, operations director of the FBI’s Cyber Branch, said the bureau is seeing these systems targeted in several infrastructure sectors around the world, with inventory and equipment put at risk. “Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” he noted.
Unpatched and exposed controllers
According to the agencies, hackers target electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities, and may exploit weaknesses in controllers that are unpatched or reachable from the internet. Possible routes in include authentication bypass and arbitrary code injection, along with weak configurations.
Once an attacker gets in, the temperature settings can be changed remotely, and a unit forced into heating “can cause widespread inventory loss and equipment hazards,” the agencies wrote. The consequences range from a shorter service life for the equipment to a fire hazard.
There is a serious public health angle, since food or medicine kept in bad conditions could “indirectly harm consumers if products are consumed after unsafe storage.” Staff could also lose sight of what is happening inside the units, a situation the agencies call a “denial-of-view condition,” in which current temperatures can’t be seen.
Take controllers off the internet
The agencies want owners and operators to act “immediately,” and the first item on their list is to stop exposing controller panels and other control system devices to the internet. Where remote access can’t be avoided, it should go through a firewall or edge device that is kept updated to its latest version.
Operators are also told to put operational technology devices on a dedicated VLAN separate from business networks, change default passwords, and turn on phishing-resistant multifactor authentication where feasible. Firmware should be kept up to date, and devices the vendor no longer supports should be retired and replaced.
The further recommendations include limiting who can make changes through device and IP address allowlisting, keeping tested offline backups, and enabling logging.
The list ends with advice specific to refrigeration, telling operators to define reasonable setpoint limits for devices downstream of controllers so they stay within safe ranges, and to set alerts for any deviation.
“The FBI urges every organization that relies on these systems to review our guidance, implement the recommended mitigations, and report any suspicious activity to the FBI,” Leatherman added.
A wave of attacks in Europe
Since October, Help Net Security has reported on a series of attacks on refrigeration systems in Europe. Hundreds of supermarkets in France were left with spoiled stock after attackers remotely hijacked the systems controlling their fridges and freezers overnight and set them to warm their contents.
Three weeks later, a second wave hit stores in Belgium, Luxembourg and Sweden, and later reports added Finland, Ireland, Estonia and the Netherlands to the list.
This week, the French Blood Establishment (EFS) confirmed that three of its blood banks detected a temperature spike in their cold rooms after one of its refrigeration equipment providers was hit.
While the attackers remain unidentified, the synchronized timing of the attacks in several European countries suggests they could be the work of a nation-state threat actor.
