FBI and CISA Alert on Cyber Threats to Refrigeration Systems

The FBI and CISA have issued a warning that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, which could lead to food spoilage, equipment damage, and fire hazards.

This alert was released in collaboration with the U.S. Departments of Health and Human Services (HHS), Agriculture (USDA), and Transportation (DOT). The agencies are urging critical infrastructure operators to secure vulnerable refrigeration controllers used in healthcare, food production, chemical facilities, and transportation.

Chris Butera, CISA’s Acting Executive Assistant Director for Cybersecurity, stated, “Every organization that depends on refrigeration and monitoring systems should assume it could be a target.”

According to a joint advisory published on November 6, attackers are exploiting vulnerabilities in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration management systems. These devices enable operators to monitor temperatures remotely, manage defrost cycles, and control cooling equipment.

CISA warned that globally, malicious cyber actors are targeting weaknesses in these systems, particularly in retail grocery and cold storage facilities.

The agencies indicated that attackers may exploit authentication bypass vulnerabilities, arbitrary code injection flaws, or weak configurations to modify temperature settings, potentially forcing refrigeration equipment into continuous heating or defrost cycles.

Successful attacks can lead to inventory losses, reduced equipment lifespan, fire hazards, and unsafe storage conditions. Attackers may also diminish visibility into current temperatures, making it difficult for operators to detect problems.

This warning follows a series of attacks against European refrigeration systems that disrupted supermarkets and blood storage facilities. In October, hackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets, remotely activating defrost functions and raising temperatures in refrigerators and freezers.

A second wave of attacks reported in November affected more than 115 stores across six European countries, with some refrigeration systems shutting down entirely and others raising temperatures to as high as 50°C (122°F).

On November 3, the French Blood Establishment (EFS) confirmed that a cybersecurity incident affecting a refrigeration equipment provider had altered temperature and defrost settings at three facilities used to store blood products.

In response to the ongoing threat, U.S. agencies are advising organizations to remove refrigeration controllers from the public internet, secure necessary remote access, change default passwords, and apply available security updates. They also recommend isolating operational technology systems from business networks and enforcing safe temperature limits to prevent controllers from operating outside acceptable ranges.

Source: BleepingComputer