Five U.S. Agencies Warn Hackers Are Targeting Refrigeration and Cold Chain Systems Worldwide, Risking Fires and Inventory Loss
The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), the U.S. Department of Agriculture (USDA), and the Department of Transportation (DOT) issued a joint advisory on November 5 warning that malicious cyber activity is targeting industrial refrigeration and cold chain monitoring systems globally. Such systems — used for automated and remote temperature monitoring, continuous temperature logging, defrost cycle management, and energy optimization — are widely used across the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors, including in refrigerated transport services.
The agencies said the actors are targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. Exploiting vulnerabilities or weaknesses in unpatched or internet-accessible controllers, the actors may remotely alter settings through authentication bypass, arbitrary code injection, or weak configurations, and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.
If successfully exploited, the actors could change temperatures in ways that affect the service life of the system, create a fire hazard, cause loss of inventory, or indirectly harm consumers if products are consumed after unsafe storage. They could also cause a loss of visibility into current temperatures, a denial-of-view condition.
"Every organization that depends on refrigeration and monitoring systems should assume it could be a target," said Chris Butera, CISA's acting executive assistant director for cybersecurity, in a statement issued with the advisory. Brett Leatherman, the FBI's Cyber Branch operations director, said the government is seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk.
The agencies urged owners and operators to act immediately: do not expose control system devices to the public internet, and protect any necessary remote access with a firewall or edge device; isolate operational technology (OT) devices on a dedicated network; change default passwords, strengthen passwords, and implement phishing-resistant multifactor authentication wherever feasible; keep firmware up to date and retire legacy devices that are at end of life and no longer supported; use allowlisting to restrict which devices and addresses can make changes; maintain current offsite, offline backups and test them; enable logging and review logs regularly; and define reasonable temperature setpoint limits with alerting for deviations. Suspicious activity can be reported to CISA's 24/7 Operations Center at [email protected] or 1-844-729-2472, or filed with the FBI's Internet Crime Complaint Center (IC3).
The advisory does not identify a specific threat actor or publish a victim count. According to Reuters, the statement follows a spate of hacks against commercial freezers in the United States and Europe. The Register reported that since mid-October, hackers have compromised thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden, raising fridge temperatures to as high as 50 degrees Celsius (122 degrees Fahrenheit), spoiling food and sparking fires; BleepingComputer reported that on November 3 the French Blood Establishment (EFS) confirmed a cybersecurity incident affecting a refrigeration equipment provider had altered temperature and defrost settings at three facilities used to store blood products.
Source: Cybersecurity and Infrastructure Security Agency
Published by GSM · USA (original Chinese edition)
Photo: 图：超市冷藏货架资料图。零售食品店与冷藏设施正是此次五部门警示点名的攻击目标场所。照片：Wilfredor，CC BY-SA 4.0，经 Wikimedia Commons。 / Photo: Refrigerated shelves in a supermarket — retail grocery and cold storage facilities are the settings named in the five-agency advisory. Photo by Wilfredor, CC BY-SA 4.0, via Wikimedia Commons.
