The U.S. government has warned that industrial refrigeration equipment is facing "persistent cyber threats." Previously, there were reports that freezers and refrigerators at supermarkets around the world, U.S. military bases, and at least one blood bank had been subjected to cyberattacks.
U.S. cybersecurity agencies CISA, FBI and several other federal government departments stated in a joint statement on Thursday that hackers are targeting and invading networked cooling and cold chain monitoring systems in grocery stores and refrigeration facilities. The statement said that these attacks affect critical infrastructure, including the food, agriculture, transportation, and pharmaceutical logistics industries.
These organizations warn that: "If the attack is successful, the attackers could potentially change the temperature, which may lead to physical consequences such as fire hazards, inventory losses, and changes in the system's lifespan."
Prior to the issuance of this warning, there have been multiple rounds of cyberattacks on industrial refrigeration equipment in the UK and various parts of Europe over the past few weeks. Two separate attacks allowed hackers to raise the temperature of freezers and refrigeration devices in at least a dozen countries, resulting in spoiled thawed food and damaged agricultural products. The affected systems included remotely controlled refrigeration equipment manufactured by the Danish company Danfoss; which had previously stopped providing security updates to its customers' freezers.
Hackers also targeted a blood bank in France, causing the temperature of their refrigeration equipment to rise, affecting the refrigeration units that store donated blood. However, the attack was stopped before it posed a threat to the blood supply. Reuters reported that the U.S. Department of Defense is investigating a series of hacker attacks on military freezers. These attacks were initially reported by Signal and Silence.
The United States has not attributed these attacks to any specific organization or government yet, but security researchers generally attribute them to Iran; American officials are also reported to suspect Iran as the most likely behind them.
CISA, FBI as well as the Ministry of Agriculture, the Department of Health and Human Services, and the Department of Transportation urge affected industries to remove remote control systems from the internet, to modify and strengthen passwords, to apply patches where possible, and to disable devices that are no longer supported by suppliers.
In another statement of facts, these departments indicated that hackers may have attempted to “force the devices into a continuous heating and defrosting cycle, thereby causing widespread inventory losses and potential device hazards.”
CISA The head of proxy network security Chris Butera stated: "Any organization that relies on cooling and monitoring systems should assume that they could become a target."
