The U.S. government has recently issued a critical advisory urging organizations to take immediate measures to secure refrigeration systems against cyber-attacks aimed at remotely altering settings, such as temperature controls. This warning has been disseminated by the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and various other federal agencies, who have highlighted their awareness of malicious cyber activities targeting industrial refrigeration and cold chain monitoring systems on a global scale.
This advisory emerges against the backdrop of a series of alarming incidents where hackers successfully infiltrated internet-connected refrigeration systems. These breaches have led to attempts to manipulate temperature settings, which can have catastrophic real-world consequences, ranging from the spoilage of food to the degradation of vital medical supplies. The potential fallout from such cyber-attacks poses significant risks not only to businesses but also to public health and safety.
One notable incident occurred on October 11, 2022, when several supermarket chains in France and throughout Europe had to dispose of considerable amounts of food stock due to the compromising of systems managed by the refrigeration provider Danfoss. Hackers managed to manipulate the system settings, increasing temperatures to a staggering 50 °C (122 °F). This attack exemplified the vulnerable state of refrigeration systems and highlighted the growing sophistication of cybercriminals.
The threat continued to escalate with a similar attack on November 1, affecting supermarkets across at least nine European countries. Most recently, a cyber-attack aimed at the refrigeration equipment supplier Coolworld had drastic consequences, causing cold storage facilities at France’s National Blood Service (EFS) to heat up to an alarming temperature of 110 °C (230 °F). Such incidents underscore the urgent need for organizations, especially those involved in sectors reliant on refrigeration, to shore up their cybersecurity defenses.
The advisory released on November 5, 2022, emphasized the necessity for owners and operators of refrigeration systems within the United States to remain vigilant in the face of potential attacks similar to those witnessed in Europe. This directive is particularly relevant for sectors such as healthcare, chemicals, food and agriculture, and transportation, which depend heavily on automated and remote monitoring systems for crucial functions. These include continuous temperature logging, the management of defrost cycles, and energy optimization.
The advisory specified that cybercriminals might exploit vulnerabilities inherent in unpatched or internet-accessible controllers, using these weaknesses to remotely change settings and force units into continuous heating and defrost cycles. Such tampering not only risks inventory loss but could also present significant dangers to equipment safety. The report indicated that hackers utilize methods like authentication bypass, arbitrary code injection, and weak configurations to gain unauthorized access to these exposed systems—a reality that underscores the critical importance of cybersecurity measures.
To counteract these risks, the advisory outlined multiple immediate actions organizations should implement to safeguard industrial refrigeration and cold chain monitoring systems against these observed threats. Recommendations included ensuring that control system devices, particularly controller panels, are not directly accessible via the internet. Organizations that require remote access were advised to employ firewalls or edge devices and to keep their systems updated to the latest versions to mitigate vulnerabilities.
Another vital recommendation involved isolating operational technology devices from business networks, thus compartmentalizing systems to limit potential entry points for cybercriminals. Organizations were also urged to change default passwords and adopt robust authentication policies, including phishing-resistant multi-factor authentication (MFA), to enhance system security.
Further, the advisory urged organizations to establish a structured lifecycle management process to identify, retire, and replace legacy devices that are no longer supported. Limiting access to only those devices and IP addresses authorized to make changes is essential, as is maintaining offsite and offline backup systems, which should be regularly tested to ensure their effectiveness in case of a security breach.
Chris Butera, CISA’s acting executive assistant director for cybersecurity, stressed the importance of awareness among organizations that depend on refrigeration and monitoring systems, urging them to act promptly to address known security vulnerabilities before they can be exploited by malicious actors.
In the aftermath of the recent incidents in Europe, data from Censys published on November 5 revealed a significant 53% reduction in the number of internet-exposed refrigeration controllers among products related to Danfoss StoreView and Copeland/Dixell XWEB. This dramatic decline in exposure appears to be a direct response to the actions taken by providers or the decision by owners to disconnect compromised devices. Despite these cautionary tales, the source of these attacks has yet to be attributed to any specific threat actor, leaving a lingering concern about the evolving landscape of cybersecurity threats targeting critical infrastructure.