Five federal agencies warn of threats to American refrigeration technology

Five federal agencies issued a joint advisory Thursday warning of continuing cyber threat activity aimed at refrigeration technology used in American health care, farming, transport and other sectors.

The joint warning came from CISA, the FBI, the Health and Human Services Department, the Agriculture Department and the Transportation Department. The advisory warns of continuing cyber threat activity aimed at refrigeration technology used in health care, farming, transport and other American sectors. Federal authorities urged grocery stores, healthcare operators and other commercial refrigeration users to strengthen security on Thursday, following cyberattacks against European freezers and fridges.

Grocery retailers reported unexpected temperature spikes in refrigeration systems, causing food spoilage in stores across Luxembourg, Belgium and Sweden. Authorities in France said on Wednesday that hackers compromised its emergency blood supply network and attempted to increase refrigeration temperatures at several blood banks. France’s national blood service said intruders affected monitoring and control systems at three sites, though staff acted to prevent intruders from compromising blood products or samples.

Danfoss, a refrigeration supplier, told Dutch customers on October 13 to disconnect systems from the public internet and use only a secure network after early French attacks. According to NOS, a Danfoss spokesperson said most stores followed the guidance.

Major supermarket chains in the Netherlands were reportedly unaffected as similar attacks arrived on November 2. At least 17 businesses, including butcher shops and small neighborhood stores, had refrigeration systems compromised in the Netherlands on November 2.

Affected systems used default passwords and remained reachable via unsecured connections, Danfoss said. A Danfoss spokesperson said taking recommended precautions would have prevented the attacks. Authorities said weak configurations, code-injection vulnerabilities and authentication bypass flaws could expose refrigeration controllers.

Intruders worldwide are exploiting flaws and poor configurations in refrigeration equipment that lacks patches or is online. Successful exploitation would let actors change temperatures and possibly cause physical impacts like fire hazards, inventory loss and reduced system service life, according to CISA.

If intruders succeed, they could adjust temperatures or force equipment into repeated heating and defrost cycles. Operators should keep control panels offline, separate operational equipment from business networks, change default passwords, require strong authentication, patch firmware and replace unsupported devices. Authorities also recommend establishing safe operating limits and alerts for temperatures outside those ranges.

The agencies gave no indication that refrigeration systems inside the United States have been hit. The alert came after reports of refrigeration outages at six American military bases during August. The Army’s criminal investigations division opened a probe into the incidents, according to Thomas Hamilton, who spoke with CBS News on Thursday.

CISA told companies using industrial refrigeration to change passwords, remove system devices from internet connections and update software to fix vulnerabilities. The recommendations apply to commercial refrigeration users across American sectors.

Chris Butera, CISA’s acting executive assistant director for cybersecurity, warned that any group relying on refrigeration and monitoring systems should treat itself as a possible target. Joshua Corman of the Institute for Security and Technology expects further attacks and warned that U.S. refrigeration systems in medical labs, grocery stores and bulk warehouses could be compromised.