US agencies warn on industrial refrigeration cyber threats after European attacks

The US FBI, Cybersecurity and Infrastructure Security Agency (CISA), Health and Human Services, and the departments of Agriculture and Transportation urged organizations to harden industrial refrigeration and cold-chain monitoring systems, warning that attacks seen in Europe could put inventory and equipment at risk. At publication, no documented digital attacks against these systems in American supermarkets were known, and the FBI had not responded to questions about any successful or attempted attacks in the US.

European attacks and US concern

Since mid-October, unknown attackers have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden, according to the source. The attacks raised temperatures inside fridges to highs of 50 C (122 F), spoiling food and sparking fires.

FBI Cyber Branch Operations Director Brett Leatherman said the agency is seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk.

There are signs that US operators are aware of the issue. Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, last month said it proactively took IT systems offline following a cyberattack that affected most of its US and European brands. Delhaize supermarkets in Europe are among those hit by the destructive freezer attacks.

The Pentagon is also reportedly treating a series of freezer malfunctions that spoiled food at military bases across the US in August as a suspected cyberattack, according to Reuters, which cited four officials familiar with the matter.

How the attacks work

In a Thursday advisory, the agencies warned that actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles. The agencies said this can cause widespread inventory loss and equipment hazards.

Attackers exploit these flaws by bypassing authentication, injecting arbitrary code, and abusing weak configurations, according to the feds. Once criminals gain access to the systems, they can change the temperature to spoil food or temperature-controlled medications, start fires, and ultimately harm people who consume products that have not been stored at proper temperatures.

Recommended defenses

The government organizations urged owners and operators to immediately implement best practices and security protections. First and foremost, they said not to expose industrial control systems and devices to the public internet.

According to the source, Iranian hackers used internet-accessible programmable logic controllers to break into more than 100 US water systems in July, and such exposed devices often lack password protection.

Other recommended tactics include creating a dedicated VLAN for operational technology devices to isolate industrial devices from business networks; replacing default passwords with strong passwords and policies and turning on phishing-resistant multifactor authentication whenever possible; applying patches in a timely manner and retiring and replacing legacy devices that no longer receive security updates from the manufacturer; defining and maintaining a device and IP allow-list and limiting access to OT devices to only those on the list; maintaining and testing backups kept offsite and offline; and enabling logging and regularly reviewing logs for unusual activity.

If remote access is necessary, the feds advise protecting it by using a firewall or edge device and updating it to the latest version to reduce security vulnerabilities.

Earlier coverage: Second Cyberattack Raises Supermarket Freezer Temperatures in Belgium and Sweden

Sources: The Register