U.S. agencies warn hackers target refrigeration equipment across food and medicine

On Thursday, U.S. agencies warned that hackers target refrigeration equipment used to keep food and medicine cold. The Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the departments of Health and Human Services, Agriculture, and Transportation issued the warning together. The notification extends to refrigeration equipment across healthcare, chemical, food and agriculture, and transportation operations.

The activity targets temperature and commercial refrigeration controllers lacking patches or reachable through the internet. Unpatched or internet-accessible controllers with security weaknesses can let attackers change system settings, potentially leading to inventory loss and equipment damage. Hackers can exploit controls exposed to the internet or systems lacking security updates, according to the warning.

If intruders succeed, they could change temperature settings and trigger nonstop heating or defrost cycles, which brings risks including spoiled inventory, damaged equipment, and fire hazards. The warning also said attackers could raise temperatures and shut off monitoring after gaining access, keeping employees from detecting issues. Attacks could destroy inventory, create fire hazards, or result in consumers eating food kept at unsafe temperatures.

Retailers in Belgium, Ireland, Sweden, and other European countries said on Monday that hackers remotely moved their freezers and refrigerators to high temperatures. A new wave of attacks struck more than 100 stores across six European countries overnight from Sunday into Monday.

Musgrave, an Irish wholesaler, said a cyber incident struck refrigeration units in 13 SuperValu stores and forced removal of some chilled and frozen goods. Delhaize and Colruyt from Belgium and Luxembourg, along with Carrefour, reported effects at several sites. In Stockholm, an ICA store manager said freezers climbed to 50 degrees Celsius (122 degrees Fahrenheit) after an overnight attack that went unnoticed for hours. A Selver supermarket in Estonia saw similar consequences.

Losses from one day of disruption reached the tens of millions of euros for one French chain. Roland Lescure, France’s finance minister, said the incident affected roughly 700 of 10,000 supermarkets and called the incident a wake-up call for food security.

In October, France’s cyber response team said hackers compromised refrigeration controls from Danfoss, Copeland, and Dixell. On Tuesday, Ireland’s cybersecurity agency said attackers accessed internet-exposed controls and urged businesses to check temperatures, defrost schedules, and alarms for changes. The FBI said an attack on blood service facilities failed because proper alert mechanisms worked.

U.S. officials did not link the European incidents to a specific group. They also did not confirm that similar attacks occurred inside the United States. The FBI encouraged organizations to adopt the recommended mitigations and report suspicious activity.

The agencies urged operators to remove control systems from the public internet and replace unsupported legacy devices. Operators should replace default and weak passwords, install available patches, and restrict or secure any necessary remote access.

Chris Butera, acting executive assistant director for cybersecurity at CISA, said, “Every organization that depends on refrigeration and monitoring systems should assume it could be a target.” Brett Leatherman, FBI Cyber Branch Operations Director, said, “Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors.”