Joint Advisory on Cold-Chain Attacks
The FBI and CISA, with HHS, USDA and DOT, issued a joint advisory warning that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide. CISA's Chris Butera said, "Every organization that depends on refrigeration and monitoring systems should assume it could be a target."
Affected sectors include healthcare, food production, chemical facilities, transportation, retail grocery and cold storage.
Targeted Systems and Methods
Targets:
- Electronic temperature controllers
- Commercial refrigeration controllers and management systems
- Cold-chain monitoring systems
Techniques:
- Exploiting unpatched or internet-exposed devices
- Authentication bypass vulnerabilities
- Arbitrary code injection flaws
- Weak configurations and default credentials
Impact: attackers can change temperature settings, force equipment into continuous heating or defrost cycles, and reduce visibility into actual temperatures so operators miss problems. Results include spoiled inventory, shorter equipment life, fire hazards and unsafe storage conditions.
Recent Incidents
| When | What happened |
|---|---|
| October | Refrigeration controllers at an estimated 250 to 350 French supermarkets were compromised, triggering defrost functions and higher temperatures |
| November | A second wave hit more than 115 stores in six European countries. Some systems shut down, others raised temperatures to 50°C (122°F) |
| November 3 | The French Blood Establishment (EFS) confirmed an incident at a refrigeration equipment provider altered temperature and defrost settings at three blood-storage facilities |
Recommended Mitigations
- Remove controllers from the public internet and secure any required remote access (VPN with MFA).
- Change default passwords on all controllers and monitoring portals.
- Apply available security updates from equipment vendors.
- Segment OT from business networks.
- Enforce safe temperature limits so controllers cannot operate outside acceptable ranges, even if settings are tampered with.
- Add independent temperature alarms that do not rely on the same controller or cloud portal.