U.S. authorities are warning operators of refrigerated warehouses, supermarkets, healthcare facilities and transport systems to secure internet-connected cooling equipment after attacks altered refrigeration settings across Europe. The joint fact sheet published November 5 by CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation says malicious actors are targeting electronic temperature controllers and commercial refrigeration controllers. [1]
The warning follows incidents affecting grocery businesses in several European countries and a separate attack on monitoring and control systems at three cold-storage sites operated by France’s blood service. The French Blood Establishment said temperature and defrost thresholds were raised to extremely high levels, but staff intervened before blood products or samples were compromised, according to The Associated Press. [5]
In the Netherlands, refrigeration supplier Danfoss said at least 17 businesses, primarily butcher shops and small stores, had their systems compromised on November 2. The company had advised Dutch customers on October 13 to disconnect the equipment from the public internet and reconnect it only through a secure network; systems that remained exposed and protected by default passwords were vulnerable, according to DutchNews. [14]
CISA and its partners did not name a CVE, threat group or specific product in the advisory, and did not report exploitation details for a particular vulnerability. Instead, the agencies warn that attackers may abuse authentication bypasses, arbitrary code injection flaws and weak configurations in unpatched or internet-accessible controllers. A successful intrusion could change temperatures, force equipment into continuous heating or defrost cycles, or cause a “denial-of-view” condition that hides current temperatures. The consequences could include spoiled inventory, shortened equipment life, fire hazards and unsafe storage of products, the agencies said. [1]
Operators are urged to remove controller panels and other operational technology from the public internet, secure essential remote access behind an updated firewall or edge device, and place OT equipment on a dedicated network separate from business systems. The guidance also calls for changing default passwords, enforcing strong authentication—including phishing-resistant multifactor authentication where feasible—restricting access by device or IP address, updating firmware and replacing unsupported equipment. Organizations should enable logging, monitor network traffic where device logs are unavailable, maintain tested offline backups, and set safe temperature ranges with alerts for deviations, according to the CISA guidance. [1]
References
- US Government Partners Urge Hardening Industrial …
- Cyberattack on French blood banks thwarted before damage …
- Albert Heijn sister chain hit as fridge hacks spread in Europe
