Five U.S. agencies warned Thursday that hackers are going after the electronic controllers that run commercial refrigerators, freezers and cold-storage systems, in joint guidance that follows tampering with store refrigeration across Europe and a Pentagon investigation into freezer failures on military bases. The Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the departments of Health and Human Services, Agriculture and Transportation told grocers, hospitals, chemical makers and refrigerated-transport operators to lock the devices down now.
What Happened
The joint fact sheet, "U.S. Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems," says the agencies are aware of malicious activity against these systems worldwide. The targets are temperature controllers in grocery stores and cold-storage warehouses: small networked computers that monitor and log temperatures and run defrost cycles.
According to the document, attackers look for controllers that are unpatched or reachable from the internet. They get in by bypassing login checks, injecting their own code or exploiting weak settings. Once inside, they can change temperature settings remotely and force units into nonstop heating and defrost cycles. They can also cause what the agencies call a "denial-of-view" condition, in which staff can no longer see current temperatures.
The listed harms range from lost inventory and shorter equipment life to fire hazards and indirect harm to consumers who use products stored at unsafe temperatures. The fact sheet names no attacker, equipment maker, specific flaw or incident.
"Every organization that depends on refrigeration and monitoring systems should assume it could be a target," Chris Butera, CISA's acting executive assistant director for cybersecurity, said in the agency's announcement. Brett Leatherman, operations director of the FBI's Cyber Branch, said in the same release, "We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk."
Why It Matters
Refrigeration controls usually belong to facilities teams, not security teams. The warning treats them as an attack surface in four sectors: health care, chemicals, food and agriculture, and transportation, including refrigerated trucking. For a hospital pharmacy or a grocery chain, a tampered setting can mean discarded stock and, the agencies say, fire risk.
The agencies' checklist for operators:
- Take controller panels off the public internet and put any remote access that is truly needed behind an up-to-date firewall.
- Move refrigeration and other operational technology, the equipment that runs physical processes, onto its own network segment, apart from business systems.
- Replace default passwords and use phishing-resistant multifactor authentication where possible.
- Update firmware and replace controllers the manufacturer no longer supports.
- Allow changes only from approved devices and network addresses.
- Keep tested offline backups, turn on logging and review it.
- Set safe temperature limits with alarms that sound when settings drift outside them.
U.S. organizations should report suspicious activity to CISA or the FBI; health care providers can contact HHS about supply disruptions.
Context
Reuters reported Thursday that at least three waves of hacks have hit commercial fridges and freezers in recent months. The Primary Wire reported in October that French supermarkets threw out chilled food after an attack on store refrigeration, and reported Nov. 3, citing AFP, that supermarkets in 11 European countries had been hit. France's blood service has also reported tampering at storage sites through a supplier. On Nov. 4, the European Union Agency for Cybersecurity (ENISA), the European Commission and Europol issued a joint statement urging organizations to cut their exposure immediately.
In the U.S., Pentagon investigators are treating August refrigeration malfunctions at grocery stores on military bases as a cyberattack, Reuters reported. Nextgov/FCW reported that roughly six commissaries have been affected since about late August, and The Primary Wire reported in October, citing Nextgov/FCW, that officials suspect Iran-linked hackers. No agency has confirmed that, and no one has claimed the European attacks.
What to Watch
Watch whether CISA names specific controllers and flaws in follow-up advisories, and whether investigators formally tie the commissary failures to the European waves or to any government. For operators, the near-term test is whether every temperature controller they run is off the public internet and alarmed.
