US agencies warn of cyber threat to industrial refrigeration

Five US agencies warned on Thursday that hackers are targeting internet-connected temperature and refrigeration controllers in grocery stores and cold storage facilities, and told operators to assume they could be next.

The joint statement came from the FBI, the Cybersecurity and Infrastructure Security Agency and the departments of health, transport and agriculture. It said unidentified "malicious cyber actors" were exploiting vulnerabilities in electronic temperature controllers and commercial refrigeration systems at retail grocery and cold storage sites, and offered little detail about who is behind the campaign.

"If successfully exploited, the actors could change the temperature and possibly cause physical impacts such as fire hazards, loss of inventory and changes to the service life of the system," the statement said.

"Every organization that depends on refrigeration and monitoring systems should assume it could be a target," said Chris Butera, CISA's acting executive assistant director for cybersecurity.

Brett Leatherman, who directs cyber branch operations at the FBI, said the government was "seeing these systems targeted across critical infrastructure sectors globally."

The agencies advised operators to disconnect controllers from the public internet, isolate them from corporate networks and apply software updates promptly.

The warning follows at least three waves of attacks on commercial fridges and freezers in recent months, according to Rappler. Reuters first reported last week that Pentagon investigators were treating a series of malfunctions in grocery store refrigeration units on US military bases in August as a cyberattack.

A hack of French supermarket freezers last month caused tens of millions of euros in damage and fires at several stores, Rappler reported. A second wave affected more than 100 stores across Europe on Monday, according to the same account.

Cold storage is used across the food supply chain, from retail grocers to warehouses and transport hubs, and the controllers the agencies described are typically reachable over the internet so staff can monitor temperatures remotely.