Based on suspected cyberattacks on European supermarkets, three regional blood banks in France, and up to six U.S. military commissaries, the federal government has advised U.S. companies that run refrigeration controllers in retail grocery and cold storage facilities to lock down their systems.
The Nov. 5 joint advisory was made by the FBI, Cybersecurity and Infrastructure Security Agency (CISA), Health and Human Services (HHS), the U.S. Department of Agriculture (USDA), and the Department of Transportation (DoT).
According to the the FBI and CISA, threat actors may exploit flaws in these refrigeration and cooling systems via an authentication bypass, arbitrary code injection, and weak configurations.
Officials said owners and operators can defend against potential cyberattacks by using strong authentication, keeping systems updated, identifying any systems that are accessible from the internet, removing unnecessary remote access, and securing any necessary remote access.
“The FBI and CISA warning hits close to home,” said Melvin Lammerts, co-founder and head of hacking at Hadrian. “We’ve already seen refrigeration controllers taken over in European supermarkets and blood-storage sites, and the Pentagon is investigating similar freezer failures at U.S. military commissaries. In each case the attackers didn’t need sophisticated malware. They reached internet-exposed or poorly- secured temperature controllers and forced them into defrost or heating mode.”
Lammerts added that every team running cold-chain systems should assume they are in scope: pull the controllers off the public internet or lock down any remote access. Change default passwords, apply available patches, and isolate the OT network. Finally, teams need to set hard temperature limits so the equipment can’t be driven outside safe ranges.
Responsibility for cyberattacks unconfirmed
To date, it's unclear who's responsible for the string of suspected cyberattacks.
Politico reported on Nov. 5 that the Pentagon said last week it was investigating recent freezer malfunctions at commissaries on U.S. military bases, and earlier this week, pro-Russian hacktivist groups claimed responsibility for the cyberattacks attacks in Europe.
Robert Costello, chief digital and information officer at Merlin Group, pointed out that a cyberattack does not have to steal a single record to hurt people: when food becomes unsafe or essential medicines are made unusable, people’s health and safety are directly affected.
“The economic damage is real, too,” said Costello. “Spoiled inventory, damaged equipment, and lost business don't disappear when a system comes back online.”
Costello added that our industry needs to recognize that many of these systems were installed years or decades ago when cybersecurity was not necessarily a major consideration in their design.
“Blaming the organizations operating this equipment does nothing to protect the people who depend on it,” said Costello. “We also cannot tell organizations to replace years of infrastructure overnight or hand them another advisory and consider the job done. Not every operator has a cybersecurity team or the funding to build one. The threats do not get smaller because an organization has fewer resources, and the people it serves deserve no less protection.”
More attacks expected
Duncan Greatwood, chief executive officer of of Xage Security, said the industry should take the FBI and CISA warning seriously as there’s every reason to expect more attacks targeting refrigeration and other critical operational systems.
“Attackers have demonstrated that they don't need to steal data to cause economic damage,” said Greatwood. “They can simply manipulate the technology that keeps food safe and available. With similar equipment used across American grocery stores, food manufacturers, and military facilities, this is not just a European problem.”
Refrigeration systems may have outdated software and exposed remote access connections used by maintenance providers, in which case a default password or an unpatched software bug may be all an attacker needs to take control, said Greatwood. Even more modern and less exposed systems are often still breachable: attackers can readily get on to the networks where the systems are connected, and AI-driven hacking lets attackers quickly find and exploit vulnerabilities.
“Organizations need to recognize that patching alone will not solve this problem,” said Greatwood. “Refrigeration systems cannot be taken offline while equipment is replaced, many older controllers no longer receive security updates, and AI can find and exploit vulnerabilities in even the most up-to-date systems. Instead, the priority should be to make critical equipment inaccessible to anyone who doesn't explicitly need access. In other words, companies need to enforce security controls in front of these systems rather than relying solely on the equipment's built-in protections.”
John Gallagher, vice president at Viakoo, added that this recent advisory — as well as more urgent and more focused guidance — should be for all OT/IoT systems. That the advisory was focused on just the attacks against refrigeration systems misses the broader issue of how OT/IoT systems are highly vulnerable unless they are using automated cyber hygiene methods to ensure firmware and passwords are updated and compliant.
“The advisory being so narrowly focused is most likely because there are now multiple waves of attacks against these systems, either because of copycat malicious hackers or because there’s a focused campaign by a nation-state actor,” said Gallagher. “Regardless of who might be behind these attacks it serves as a great way for organizations to build up some ‘muscle memory’ on effective OT/IoT cyber hygiene. What the federal government has advised on refrigeration units applies directly to other forms of vulnerable OT/IoT systems, such as building automation, HVAC, lighting, security, and access control, among others.”
Jason Brown, director of customer advisory counter fraud lead at iCounter, pointed out that three weeks ago Danfoss told its customers to take these controllers off the internet. While most did, a small number didn’t, and on Sunday night someone found those stores.
Brown said between the two waves, researchers watched login attempts against decoys built to look like these controllers, and most of them used the factory default passwords the manufacturer publishes in its own documentation: that looks like someone taking inventory of what was still left open.
“When I was investigating cybercrime at the Secret Service, a second wave was always the most useful one to investigators because the pattern has now been repeated across more than 100 sites in at least nine countries, and repeated patterns leave evidence,” said Brown. “The harder problem for retailers is that many of them don’t know who holds the keys to their refrigeration. These controllers are often installed and remotely serviced by outside refrigeration contractors. A franchise owner or an independent butcher shop may never have seen the login page.”
Brown said every grocer should ask their refrigeration and building maintenance providers three questions this week: Is any controller reachable from the internet? Have the default credentials been changed? How does your technician connect remotely? Brown said store managers should also treat a sudden temperature alarm as a possible security incident.
“One warm freezer looks like a maintenance call until a few hundred of them fail on the same night,” said Brown.
Joe Slowik, director of threat research at Dataminr, which published an intel brief on these incidents, said organizations operating building control systems need to assess their exposure in terms of internet-facing assets, then work to limit that exposure through available means.
Slowik said they'll need to do the following: update relevant systems, apply patches, and look into costly system upgrades for end-of-life equipment.
