Circuit Wire — a daily news update from the Circuit.
The FBI and CISA warned on Thursday, November 5, that attackers are actively targeting industrial refrigeration and cold-chain monitoring systems, according to BleepingComputer and TechCrunch.
The joint warning also carries the names of the Departments of Health and Human Services, Agriculture and Transportation. It says attackers are exploiting unpatched or internet-exposed temperature controllers. They use authentication bypass flaws, code injection or weak configurations to change temperature settings and force equipment into continuous heating or defrost cycles. The agencies list inventory losses, shorter equipment life and fire hazards among the possible effects. Healthcare, food production, chemical facilities and transportation are named as exposed sectors, with retail grocery and cold storage singled out.
BleepingComputer reports that hackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets in October. A second wave in November affected more than 115 stores. Some systems shut down entirely, and others reached 50°C (122°F). TechCrunch reports that some affected units were remote-controlled systems made by the Danish company Danfoss, which had stopped providing security updates for them.
The warning follows two waves of attacks in Europe that TechCrunch says raised temperatures on freezers and chillers in at least a dozen countries, spoiling food and destroying produce. The agencies describe the activity as an ongoing cyber threat to retail, food, agriculture and medicine shipping.
The French Blood Establishment confirmed on November 3 that an incident at a refrigeration equipment provider changed temperature and defrost settings at three facilities that store blood products. TechCrunch reports the attack was stopped before it compromised blood supplies.
The Pentagon is also investigating hacks on freezers at military bases, TechCrunch reports, citing Reuters. The number of bases affected has not been made public. The U.S. government has not attributed the attacks to a specific group or government. TechCrunch notes that researchers have broadly linked them to Iran, citing NPR.
The agencies advise operators to remove controllers from the public internet, secure any remote access they need, change default passwords, apply security updates, isolate operational technology from business networks and enforce safe temperature limits. Chris Butera, CISA's acting executive assistant director for cybersecurity, said: "Every organization that depends on refrigeration and monitoring systems should assume it could be a target."
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.