Five federal agencies warn of cyber threat to internet-linked refrigeration systems

A joint statement from five federal agencies warned Thursday that refrigeration systems and cold chain monitors linked to the internet face an ongoing cyber threat.

The warning came from CISA, the FBI, the Department of Agriculture, the Department of Health and Human Services, and the Department of Transportation. The five agencies signed the joint statement on Thursday. Supermarket freezers around the world, refrigerators at U.S. military bases, and one blood bank were among the reported hacks that preceded the alert. The statement addressed ongoing cyber threat activity against refrigeration systems.

Hackers target medicine-shipping, transportation, agriculture and food industries. Those targets include grocery stores and cold storage facilities where refrigeration systems operate. The agencies also issued a notice describing active threats to refrigeration systems across healthcare, agriculture, transportation and other U.S. industries.

The agencies said actors could change temperatures if they exploit a vulnerability. That access could cause physical effects including fire hazards. It could also lead to inventory loss and reduce system service life. Cooling systems that lack patches or connect to the internet have security gaps that threat actors worldwide are exploiting in food storage and healthcare settings.

Military freezers are the subject of a Defense Department investigation into a series of hacks. Army criminal investigators launched an inquiry into the refrigeration incidents. Thomas Hamilton, a public affairs officer for the Department of the Army Criminal Investigation Division, told CBS News on Thursday that the division had opened the investigation into refrigeration outages at six U.S. military bases in August.

The agencies issued defensive guidance on Thursday. Operators received instructions to disconnect remote control systems. The agencies told operators to strengthen passwords. The guidance also said to install available patches and retire vendor equipment that is no longer supported.

A separate fact sheet issued Thursday warned that attackers may set off repeated heating and defrost cycles. Those cycles could cause widespread inventory loss and equipment hazards. The sheet addressed risks to organizations operating cooling equipment.

Chris Butera serves as an acting CISA cybersecurity chief. He said every organization that uses refrigeration or monitoring systems should treat itself as a possible target. His remarks appeared in the joint statement from the five agencies. U.S. officials have not assigned responsibility for the hacks to any particular group or government.

Researchers have broadly connected the attacks to Iran, and U.S. officials reportedly believe Iran is probably responsible. In recent weeks, waves of attacks struck industrial refrigeration units across the United Kingdom and Europe. The attacks spoiled food in at least a dozen countries.

Sellers of groceries in Luxembourg, Belgium and Sweden reported sudden temperature spikes in cooling systems. The increases spoiled food in their stores. The incidents took place in recent weeks. Similar issues affected grocery retailers in other European countries.

In France, hackers targeted a blood bank and increased temperatures in refrigerated units that held donated blood. The intrusion ended before attackers compromised blood supplies. French officials said on Wednesday that hackers targeted the national emergency blood supply network. The officials said the attackers tried to increase temperatures at blood banks.

Danfoss, a Danish company, produced some affected remote-controlled refrigeration units. The vendor no longer provides security updates for its customers’ freezers. The hacks were first reported by Signal and Silence.

The company’s equipment was among the systems affected by the hacks.

The agencies did not say whether attackers have targeted any refrigeration systems in the United States. Joshua Corman works for the Institute for Security and Technology and expects more attacks. He said medical labs, grocery stores and bulk warehouses in the United States could see refrigeration systems compromised. The expectation covers many types of commercial and medical facilities.

The Institute for Security and Technology identifies Joshua Corman as its executive-in-residence for public safety and resilience. CBS News described him as a security expert who expects more attacks on refrigeration systems. The CBS News report included his full title and organizational affiliation.