Five US agencies warn that hackers are targeting refrigeration controllers that protect food and medicine
CISA, the FBI, HHS, USDA and DOT say attackers are exploiting exposed temperature controllers and can force units into constant heating and defrost cycles.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Five US federal agencies issued a joint advisory on Thursday about attacks on industrial refrigeration and cold-chain monitoring systems around the world. The agencies are CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation. They say attackers are exploiting unpatched or internet-accessible electronic temperature controllers and commercial refrigeration management systems in grocery stores and cold storage facilities. Operators use these devices to monitor temperatures remotely, manage defrost cycles and control cooling equipment. According to BleepingComputer, the advisory says attackers may use authentication bypass flaws, arbitrary code injection or weak security settings. Help Net Security reports that attackers may push units into continuous heating and defrost cycles. The possible results include food spoilage, equipment damage and fire hazards. The warning covers healthcare and public health, chemical, food and agriculture, and transportation organizations, including refrigerated transport. "Every organization that depends on refrigeration and monitoring systems should assume it could be a target," said Chris Butera, CISA's acting executive assistant director for cybersecurity. Brett Leatherman, operations director of the FBI's Cyber Branch, said the bureau is seeing these systems targeted in several sectors worldwide. The advisory comes after repeated attacks this autumn that warmed fridges and freezers in European supermarkets. It turns those attacks into a formal warning to US critical infrastructure operators.