The US government has issued a critical advisory urging healthcare, chemical, food, and transportation sectors to fortify their industrial refrigeration and cold chain monitoring systems. This call to action follows a series of cyberattacks targeting these systems across Europe, resulting in significant financial and operational damage. In early October, attackers compromised refrigeration systems in hundreds of supermarkets, causing temperatures to spike to 50 degrees Celsius. This led to both food spoilage and fires. A subsequent wave of attacks affected over 100 supermarkets and a blood bank, although prompt intervention prevented any impact on blood products.
Security agencies, including CISA, the FBI, HHS, USDA, and DoT, have confirmed that cyber actors are exploiting vulnerabilities in electronic temperature controllers. These actors can remotely alter settings to induce continuous heating or defrost cycles, leading to damage and potential hazards. The attacks exploit authentication bypasses, code injections, and weak configurations to gain unauthorized access to these systems.
According to Censys, an internet intelligence firm, a significant number of refrigeration controllers remain exposed online. A recent analysis showed that while exposure has decreased, thousands of units are still vulnerable. Specifically, 47% of identified controllers remain accessible, even after a drop in exposure for controllers like Copeland/Dixell XWEB and Danfoss StoreView.
To mitigate these threats, the US government recommends removing these systems from the internet. If online access is essential, implementing firewalls or edge devices is critical. Organizations are also advised to isolate operational technology devices, restrict access to trusted entities, enforce strong password policies and multi-factor authentication, ensure systems are up to date, maintain offsite backups, and enable comprehensive logging and monitoring measures.
