Hackers are targeting refrigerators worldwide, US agencies warn

Federal agencies warned Thursday that hackers are targeting refrigeration systems worldwide, urging operators to secure equipment whose recent failures have spoiled food and created fire hazards.

CISA, the FBI, and the departments of Health and Human Services, Agriculture, and Transportation issued joint warnings that attackers are targeting electronic temperature controls at grocery stores and cold storage facilities. 

The warning follows Nextgov/FCW’s report last week that U.S. officials suspect Iran-linked hackers were behind freezer malfunctions at military bases across the country. Those incidents began around late August and have affected roughly six commissaries, the on-base grocery stores that serve military personnel. Reuters initially reported that the Pentagon was treating the freezer incidents as possible cyberattacks.

In France, hackers targeted refrigeration systems at three regional blood banks overnight Sunday into Monday. And this week, a new wave of supermarket attacks raised fridge temperatures at stores in Sweden, Belgium, Luxembourg and elsewhere, forcing retailers to discard food. The incidents followed attacks at hundreds of French establishments in October. 

The U.S. notice does not name who is responsible for the cyber sabotage. 

Hackers could force refrigerators and freezers into continuous heating or defrost cycles, the agencies said. They could also prevent operators from seeing current temperatures, making it harder to monitor conditions inside the units. Beyond spoiled inventory and damaged equipment, the agencies warned of fire hazards and potential harm to consumers who use products kept at unsafe temperatures.

Such hacks are possible because various digital vulnerabilities tied to refrigeration controls can expose their underlying equipment to hacking and sabotage, including devices connected to the internet that are used to remotely monitor or control temperatures.

“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity.

Hospitals, pharmaceutical suppliers, chemical companies and transportation providers also depend on these systems.

“We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk,” said Brett Leatherman, the FBI’s cyber branch operations director.

The agencies urged operators to remove control systems from the public internet and secure any remote access they still need. They also recommended separating refrigeration controls from business networks, replacing default passwords, installing security updates and retiring equipment that manufacturers no longer support.

The hacks follow a pattern closely aligned with Iranian hackers, said Nahman Khayet‏, the co-founder and CEO at Alt Security.

“They’ve been playing this game for many years,” he said in an interview. “Think about how hard it is to replace those refrigerators, right? They’re huge things. It’s very costly. And also you don’t want to do any disruption to those because they probably hold a lot of items which are important, like food.”

That dynamic means that it’s unlikely the devices are getting the latest security updates, which Iranian cyber operators have often leveraged to get inside systems, including various types of critical infrastructure, he added.

European authorities issued their own joint warning Wednesday, calling for immediate action to secure exposed equipment. The European Commission, cybersecurity agency ENISA, Europol and national authorities are coordinating their response and sharing information about the incidents.