Critical Infrastructure Orgs Warned of Cyberattacks on Refrigeration and Cold Chain Monitoring Systems
A joint cybersecurity warning has been issued by the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services, and other government agencies warning of potential cyberattacks targeting the refrigeration and cold chain monitoring systems used in healthcare and public health and other critical infrastructure sectors.
Attacks on European Refrigeration Facilities
The warning was issued days after a series of cyberattacks on the refrigeration systems used by the food supply chain in Europe. An unknown hacker or group started hitting refrigeration systems in mid-October, raising the temperature of cooling units. In one instance, parameters were altered that would have raised temperatures to 302°F (150°C) had the issue not been identified and corrected. Hundreds of supermarkets in France were forced to throw away large amounts of produce due to dangerously high temperatures caused by remote activation of defrosting functions in refrigerators and freezers, and attacks have since spread across Europe.
The French blood bank, EFS, was caught up in the attacks and experienced a near-catastrophic temperature rise due to remotely altered temperature and defrosting thresholds. EFS reported that temperatures were increased to very high levels in certain cold storage rooms used to keep blood products prior to distribution to healthcare and manufacturing facilities. Fortunately, the temperature increase was identified, and action was taken in time to prevent catastrophic loss of blood products.
While the source of the attacks has not been confirmed, analyses have shown that the bulletproof hosting used in the attacks has previously been used by Russia-linked malicious operations, although that alone does not confirm these as state-sponsored hacking attempts. In many cases, temperature control systems were remotely accessed using the manufacturer’s default credentials.
Warning to U.S. Critical Infrastructure Entities
While the current wave of attacks appears to be targeted at Europe, attacks may spread globally. The warning applies to every organization that uses refrigeration and monitoring systems, including healthcare organizations, food and chemical production facilities, and transportation, as they could potentially be targeted. According to the alert, malicious cyber actors are targeting vulnerabilities and weaknesses in unpatched or internet-accessible temperature controllers and commercial refrigeration controllers. Successful attacks could result in food spoilage, loss of inventory, fire hazards, and hardware damage.
Hackers are gaining access to temperature control systems remotely, so the most logical step to take to harden security is to ensure that the control systems cannot be accessed via the internet. In many attacks, default credentials have been used to alter temperature control settings. All default passwords should be changed, and passwords strengthened to protect against brute force attempts to guess passwords. All software should be kept up to date, with patches applied promptly, and if legacy devices are used that are no longer supported by the vendor, they should be retired and replaced.
“Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” explained FBI Cyber Branch Operations Director Brett Leatherman. “We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk. This fact sheet provides clear, practical steps that network defenders can take to reduce that risk and protect operations. The FBI urges every organization that relies on these systems to review our guidance, implement the recommended mitigations, and report any suspicious activity to the FBI.”
