Federal agencies warned on Nov. 5 that hackers are actively breaking into internet-connected freezers and cold-chain monitoring systems at grocery stores and cold storage facilities. The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI signed the notice together with the Agriculture, Health and Human Services, and Transportation departments. Their joint statement calls the activity an ongoing cyber threat to food, agriculture, transportation and the shipping of medicine.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The risk reaches well past stolen data. An intruder who controls a refrigeration unit can change its temperature settings, and the agencies list fire hazards, spoiled inventory and shortened equipment life among the physical consequences.
Chris Butera, CISA’s acting executive assistant director for cybersecurity, framed the notice as a warning to every operator, not only to the sites already hit. In the agencies’ news release, he said: “Every organization that depends on refrigeration and monitoring systems should assume it could be a target.” A companion fact sheet lays out the technical guidance for operators of the affected equipment.
Electronic temperature controllers and refrigeration management systems
According to BleepingComputer’s reading of the advisory, the attackers go after unpatched or internet-accessible electronic temperature controllers and commercial refrigeration management systems. Entry points named include authentication bypass flaws, arbitrary code injection and weak configurations. Healthcare, food production, chemical facilities and transportation are listed as exposed sectors, alongside retail grocery and cold storage.
The worst-case playbook is blunt. Attackers can push units into continuous heating and defrost cycles, as TechCrunch reported, which wrecks stock on a wide scale and strains compressors. They can also reduce an operator’s view of current temperatures, so a failing freezer may look normal on a dashboard until product is already ruined.
Defrost cycles are the lever that makes this attack work. A commercial freezer periodically warms its coils to clear ice, then returns to cooling, and a controller that is told to keep defrosting never gets back to the cold set point. Because the settings sit in software reachable over the network, an attacker does not need to touch the hardware, and a single compromised management console can reach every case in a store or every room in a warehouse.
French supermarkets, European stores and a blood bank
The notice follows a string of incidents in Europe. In October, hackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets and remotely activated defrost functions, raising fridge and freezer temperatures, BleepingComputer reported. A second wave in November reached more than 115 stores across six European countries, where some systems shut down entirely and others climbed to as high as 50 degrees Celsius (122 degrees Fahrenheit), according to a separate report.
Medicine was touched too. On Nov. 3 the French Blood Establishment said a cybersecurity incident at one of its refrigeration equipment providers had altered temperature and defrost settings at three facilities that store blood products, per the organization’s statement. TechCrunch added that the attack was stopped before it reached the donated blood supply.
Closer to home, TechCrunch, citing Reuters, said the Department of Defense is investigating a series of hacks on freezers run by the military. Some affected European units were remote-controlled equipment from the Danish maker Danfoss, which had stopped issuing security updates for customers’ freezers.
Taken one at a time, the European incidents look like retail disruptions, but the agencies group them with the blood bank case and the military freezers as one pattern. The sectors named in the joint statement, food, agriculture, transportation and medicine shipping, all depend on product staying within a narrow temperature range from the farm or the pharmacy supplier to the shelf, so a failure at one cold-storage node can ripple down a distribution chain.
Steps the agencies want operators to take
The mitigation list is short and mostly basic hygiene. Operators should take refrigeration controllers off the public internet, secure any remote access that has to stay, replace default passwords with strong ones, and apply patches where the vendor has released them. The fact sheet also calls for isolating operational technology from business networks and for enforcing safe temperature limits so a controller cannot be driven outside an acceptable range.
Equipment that its maker no longer supports is a harder problem, since no patch is coming. The agencies advise retiring such units, a costly step for a small grocer running decade-old controllers.
For smaller operators the practical hurdle is knowing what is connected. Many refrigeration controllers were installed by a contractor years ago with remote access switched on for convenience, and nobody on staff may know the unit answers to the public internet. The fact sheet’s first step, taking controllers off the internet, therefore starts with an inventory of what is reachable.
Who is behind the campaign remains unsettled. The government has not blamed a specific group or country, though TechCrunch noted that security researchers have broadly linked the attacks to Iran and that U.S. officials reportedly suspect it. Neither the news release nor the coverage gives a count of compromised devices in the United States, so the scale of American exposure is the open question operators will be asking next.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
