US warns of ’ongoing cyber threat’ to industrial refrigeration systems

On November 5th, the United States issued a warning about an ongoing cyber threat to industrial refrigeration systems, according to a statement issued by the FBI, the Cybersecurity and Infrastructure Security Agency, and other government departments. The statement emphasized that every organization relying on cold storage must assume their systems could be targeted by hackers.

Recent hacks against commercial freezers in the United States and Europe prompted this warning, as unidentified malicious cyber actors targeted vulnerabilities in internet-accessible electronic temperature and commercial refrigeration controllers in retail grocery and cold storage facilities. The threat is considered ongoing, with the potential for hackers to manipulate temperature settings, leading to fire hazards, loss of inventory, and reduced system lifespan, if the attacks are successful.

Chris Butera, acting executive assistant director for cybersecurity at CISA, stated that all organizations relying on refrigeration and monitoring systems should treat their systems as potential targets. FBI Cyber Branch Operations Director Brett Leatherman noted that such attacks are being observed across critical infrastructure sectors globally.

The government advised operators of industrial refrigeration control systems to disconnect their devices from the public internet, isolate them from corporate networks, and promptly apply software updates. At least three waves of hacks have targeted commercial fridges and freezers in the recent months, prompting Pentagon investigators to treat a series of mysterious malfunctions at US military bases in August as a potential cyberattack.

A recent French freezer hack caused significant financial damage, while a second wave affected over 100 stores across Europe, raising concerns about hackers' potential to remotely manipulate critical devices.