Federal agencies warn organizations about potential cyberattacks on industrial refrigerators

The U.S. government encouraged grocery stores, healthcare facilities and other businesses that use commercial refrigeration to tighten their security measures on Thursday following a series of cyberattacks that remotely changed the temperatures of commercial freezers and fridges across Europe.

Five federal agencies issued a joint notice, warning of “ongoing cyber threat activity” that could target refrigeration systems used across healthcare, agriculture, transportation and other U.S. industries. 

Bad actors globally are exploiting vulnerabilities and weaknesses in refrigeration systems that are “unpatched” or connected to the internet, the agencies said.

“If successfully exploited, the actors could change the temperature and possibly cause physical impacts such as fire hazards, loss of inventory and changes to the service life of the system,” the Cybersecurity and Infrastructure Security Agency (CISA) said in a statement, which was issued in conjunction with the FBI, Department of Health and Human Services, Department of Agriculture and Department of Transportation.

In a fact sheet, CISA said businesses that rely on industrial refrigeration should take precautions to protect their systems, including changing passwords, disconnecting system devices from the internet and making software updates to address vulnerabilities.

“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,”  Chris Butera, acting executive assistant director for cybersecurity at CISA, said in a statement.

The agencies did not specify if any refrigeration systems have been targeted in the U.S.

Wave of refrigeration attacks

The warning follows reports of refrigeration outages at six U.S. military bases in August. The Department of the Army Criminal Investigation Division, a U.S. federal law enforcement unit, has launched an investigation into the incidents, Thomas Hamilton, a public affairs officer for the department, told CBS News on Thursday. 

Similar incidents have occurred around Europe in recent weeks, with hackers targeting fridges and freezers across numerous grocery chains. Food retailers reported unexpected temperature spikes in their refrigeration systems, causing food to spoil in stores in Luxembourg, Belgium and Sweden. 

Officials in France, which has also been hit by grocery store cyberattacks, said on Wednesday that its national emergency blood supply network was targeted by hackers who tried to raise refrigeration temperatures at several blood banks.

Joshua Corman, executive-in-residence for public safety and resilience at the Institute for Security and Technology, a security think tank, said he expects more such attacks, warning that refrigeration systems used by medical labs, grocery stores and bulk warehouses in the U.S. could be compromised.

“There’s only so many players that do industrial-level refrigeration, and they’re likely also just as vulnerable,” he told CBS News.