U.S. federal agencies are warning businesses to protect their industrial refrigeration systems from hackers after a series of cyberattacks hit supermarkets and other sites across Europe this fall.
The Cybersecurity and Infrastructure Security Agency and the FBI released a joint statement recently, along with the U.S. Department of Agriculture, the Department of Health and Human Services, and the Department of Transportation.
In it, the agencies urged owners and operators to “immediately” take steps to protect their equipment. That includes keeping control devices off the public internet, updating device firmware, and reporting any unusual activity.
The agencies pointed to recent “malicious cyber activity” aimed at refrigeration and cold storage monitoring systems in Europe as the reason for the alert.
Per the statement, systems that can be reached from the internet are at risk. Hackers who get in can change temperatures, which can lead to fires, spoiled inventory, and damaged equipment. People could also be harmed if they eat food that wasn’t stored safely. Furthermore, businesses may lose the ability to see what temperature their systems are running at.
How the breaches unfolded
The warning follows several attacks in Europe. In early October, hackers took control of the refrigeration systems at hundreds of grocery stores in France and raised the temperature to 120 degrees Fahrenheit. The attack caused fires, ruined food, and millions of dollars in damage.
A few weeks later, a second wave of attacks hit dozens of refrigeration devices at major grocery chains in several European countries. This time, the hackers switched the systems into defrost mode.
The campaign quickly expanded beyond food retail into critical healthcare infrastructure. Attackers went after the French Blood Establishment, which manages France’s blood supply, and altered the temperature controls in cold storage rooms at three of its sites, though the agency stated that automated alarms alerted staff in time to keep the blood supply safe.
Sources: CISA Newsroom, CISA Joint Fact Sheet, French Blood Establishment (EFS), Food Dive