Five federal agencies warn of attacks on freezer controls

Five federal agencies told operators of industrial refrigeration systems on Nov. 5 to disconnect temperature controllers from the public internet, warning that hackers are remotely altering settings and forcing units into continuous heating and defrost cycles.

The joint advisory was issued by the Cybersecurity and Infrastructure Security Agency, the FBI and the Departments of Health and Human Services, Agriculture and Transportation. It describes the activity as ongoing and global, aimed at electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage sites. It names no country and no group.

The Register reported on Nov. 5 that it had asked the FBI whether the bureau had documented any successful or attempted attacks on refrigeration and cold chain monitoring systems in the United States and had received no response by publication, and that it was aware of no documented digital attacks on American supermarkets.

What the agencies told operators

Attackers may exploit controllers that are unpatched or reachable from the internet, the agencies said. Routes in include authentication bypass and arbitrary code injection, along with weak configurations. Once an intruder has access, temperature setpoints can be changed from anywhere.

The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards

The listed consequences run from a shortened service life for the equipment to fire. Food or medicine kept in bad conditions could indirectly harm consumers who use the products after unsafe storage, the agencies wrote. Staff can also lose sight of conditions inside a unit, a state the advisory calls a denial-of-view condition.

First on the list of mitigations is to stop exposing control system devices to the public internet. Where remote access cannot be avoided, the agencies want it behind a firewall or edge device kept at its latest version. They also call for operational technology on a dedicated VLAN separate from business networks, default passwords replaced, phishing-resistant multifactor authentication where feasible, firmware kept current and unsupported devices retired.

Six commissaries, no established cause

Fox News Digital reported that at least six commissaries, the grocery stores on military bases that serve military personnel, had refrigeration problems in late August. Fort Huachuca in Arizona said in an Aug. 26 Facebook post that all of its frozen food had spoiled. Fort Irwin in California limited commissary sales to dry goods after its malfunction.

The Army Criminal Investigation Division's Cyber Field Office is working with the Defense Commissary Agency and the Defense Criminal Investigative Service to determine what caused the failures, an Army CID spokesperson confirmed to Fox News Digital. A cyberattack has not been established as the cause.

Reuters reported, citing four officials familiar with the matter, that the Pentagon is treating the August failures as a suspected cyberattack. In at least one case, refrigeration units were set to higher temperatures overnight rather than simply shutting off.

Nextgov/FCW reported on Oct. 29 that U.S. officials suspect Iran-linked hackers were behind freezer malfunctions at military bases across the country. TechCrunch reported that the United States has not attributed the hacks to a particular group or government, and that security researchers have broadly attributed the attacks to Iran. One security firm has instead pointed to Russia for the European attacks.

Nicole Parker, a former FBI special agent, told Fox News Digital that cyberattacks on the systems people rely on for food and other essentials could also strike the United States, and described the danger as asymmetrical warfare in which an attacker can disrupt daily life without firing a missile or sending troops. She cautioned against drawing conclusions about who was responsible. "Again, we don't know who did this," she said.

The European wave since October

A large attack on October 12 forced refrigerators to defrost at Intermarché and Coopérative U stores in France. Between 150 and 200 Intermarché stores were hit, along with nearly 100 Coopérative U outlets, and one retailer put the losses at tens of millions of euros. BFM TV reported that the rival chain E. Leclerc was also affected, with hackers remotely triggering forced defrosting in many stores.

A second wave hit more than 100 stores across Europe on Nov. 2. Reuters reported that affected businesses included stores in Sweden, Belgium and Luxembourg, with temperatures in some systems reaching 122 degrees Fahrenheit. The Register reported that hundreds of grocery stores in France, Belgium, Ireland, Luxembourg and Sweden have been hacked since mid-October.

The Irish supermarket chain SuperValu said on Nov. 2 that refrigeration systems of one specific model were affected in 13 of its 223 stores, and that chilled and frozen products were removed from sale.

Three plasma storage sites used by France's blood service were targeted overnight Nov. 1 into Nov. 2. The French Blood Establishment, known as EFS, confirmed a temperature spike in the cold rooms after one of its refrigeration equipment providers was hit, and said no blood products were lost.

Some of the affected systems were older remote-controlled refrigeration units made by the Danish company Danfoss, models the company no longer updates. European authorities issued their own joint warning on Nov. 4, calling for immediate action to secure exposed equipment, with the European Commission, the cybersecurity agency ENISA, Europol and national authorities coordinating their response.

Ahold Delhaize and US exposure

Ahold Delhaize, the Dutch grocery group that operates Food Lion, Giant Food and Stop & Shop in the United States, said in October that it proactively took IT systems offline after a cyberattack that affected most of its US and European brands. Delhaize supermarkets in Europe are among those hit by the freezer attacks. The Dutch National Cyber Security Centre said it saw no reason to link Ahold's IT incident to the freezer attacks.

The hacks follow a pattern closely aligned with Iranian hackers, said Nahman Khayet, the co-founder and CEO at Alt Security. "They've been playing this game for many years," he told Defense One. He added that industrial refrigerators are costly and hard to replace, and that operators avoid disrupting units holding food, which makes it unlikely the devices are getting the latest security updates.

In July, hackers targeted more than 100 US water systems through internet-exposed programmable logic controllers, CISA said, and US officials suspected Iran.

The advisory also tells operators to limit who can make changes, through device and IP address allowlisting, and to keep tested backups offline and offsite. Logging should be switched on and reviewed for unusual activity. For refrigeration specifically, it asks operators to define reasonable setpoint limits for devices downstream of controllers and to set alerts for any deviation.

Chris Butera, CISA's acting executive assistant director for cybersecurity, said the agency is actively tracking the threat activity in collaboration with government, industry and international partners. "Every organization that depends on refrigeration and monitoring systems should assume it could be a target," he said.

Brett Leatherman, operations director of the FBI's Cyber Branch, said the bureau is seeing these systems targeted in several infrastructure sectors around the world, with inventory and equipment put at risk. The identity of those behind the European incidents remained unknown as of Nov. 4, Reuters reported.

What remains unestablished

Fox News Digital reported that investigators are also working with French law enforcement as they examine whether the US failures could be linked to the refrigeration outages in Europe.

The joint statement gave few details about the hackers, and the agencies did not name any affected US company. In the fact sheet, the agencies set out the forced heating and defrost scenario and told owners and operators to act immediately.

Leatherman said the FBI is asking every organization that relies on these systems to review its guidance and apply the recommended mitigations. Suspicious activity should be reported to the bureau.