US agencies warn of cyber threats to industrial refrigeration

Federal agencies are urging businesses that rely on industrial refrigeration to secure their systems after hackers remotely altered temperatures in refrigerators and freezers across Europe, spoiling food and raising concerns about supplies of blood and medicine.

Five U.S. agencies issued a joint warning Thursday about “ongoing cyber threat activity” targeting refrigeration and cold-chain monitoring systems used in healthcare, agriculture, transportation and other industries. They said attackers are exploiting unpatched systems and devices connected to the internet.

“If successfully exploited, the actors could change the temperature and possibly cause physical impacts such as fire hazards, loss of inventory and changes to the service life of the system,” the Cybersecurity and Infrastructure Security Agency said. CISA issued the notice with the FBI and the departments of Health and Human Services, Agriculture and Transportation.

The agencies advised organizations to change passwords, disconnect system devices from the internet and install software updates that address vulnerabilities. “Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity. The agencies did not say whether refrigeration systems in the United States had been targeted.

Food retailers have reported unexpected temperature spikes that spoiled food in stores in Luxembourg, Belgium and Sweden. French officials also said hackers tried to raise refrigeration temperatures at blood banks. According to NPR, the French Blood Establishment said a vendor used in its cold-storage rooms was targeted, pushing defrost and temperature thresholds dangerously high. The organization detected the activity in time to rescue blood samples.

Health ISAC, an information-sharing group for the healthcare industry, alerted members to the attacks. “This incident underscores a stark operational reality: cybersecurity in healthcare is fundamentally about patient safety,” its chief security officer, Errol Weiss, told NPR. Blood, vaccines and other medical supplies can require tightly controlled temperatures to remain usable.

CBS News reported that refrigeration outages occurred at six U.S. military bases in August. The Department of the Army Criminal Investigation Division is investigating those incidents, a spokesperson told CBS News. The cause of the outages has not been established in the sources.

Who is behind the broader wave of attacks remains unclear. NPR reported that investigators are considering Iran as a possible culprit in the military-base disruptions, while two pro-Russian hacking groups have claimed responsibility for attacks in Europe. Cybersecurity experts told NPR that more evidence is needed to assess those claims.

NPR also reported that thousands of refrigeration controllers in France were exposed to the public internet with little protection before hackers targeted them in October. Security researchers have identified vulnerabilities in controllers made by Copeland and Danfoss, though vendors have developed patches for some of the flaws. Installing updates can be difficult when shutting down a cooling system risks the products it protects.

“Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” said Brett Leatherman, director of FBI Cyber Branch Operations.