US officials warn of cyberattacks on food and healthcare cold-chain systems

“Attackers are getting in through controllers that are unpatched, reachable from the internet, or still using the default passwords listed in the manufacturer’s manual,” said Brett Leatherman, head of the FBI Cyber Division, in a joint advisory issued Thursday. The warning from the FBI, Cybersecurity and Infrastructure Security Agency, Health and Human Services, and U.S. Department of Agriculture urged organizations to immediately secure industrial refrigeration and cold-chain monitoring systems after hackers remotely altered settings at more than 350 European supermarkets and several French blood banks, Fox8 reported.

The attacks, which came in two waves in mid-October and again days ago, raised temperatures in cold storage units to as high as 122 degrees Fahrenheit, forcing suppliers to discard food worth tens of millions of euros, Fox8 reported. The Guardian described the effect as though “a ghostly hand had switched the settings on supermarket freezers across Europe from ‘freeze’ to ‘defrost.'” At French blood banks, surveillance systems triggered alarms and equipment was taken offline, but the French Blood Establishment confirmed no blood products were lost, with samples promptly transported to other facilities, Fox8 reported.

The joint U.S. warning specifically targets the controllers that manage cooling systems in health care, food, and agriculture. Officials urged organizations to eliminate public internet exposure, isolate operational technology from office networks, and enforce credential security, according to the CISA fact sheet.

Attacks Span from Israel to Europe; Attribution Remains Disputed

Earlier this year, a food plant in Israel suffered a similar attack when hackers changed control settings and passwords on refrigeration equipment, locking engineers out of the systems they were called to repair, Ynetnews reported. Israeli cybersecurity company Profero investigated and attributed the attack to Cyber Isnaad Front, a group it believes is linked to Iran’s Revolutionary Guards, though Ynetnews noted there is no public evidence tying the group to the European attacks.

A top cybersecurity official from Romania characterized the European threat as “semi-amateurish,” telling the AFP news agency, “We do not suspect, under any circumstances, that it is a state actor,” Fox8 reported.

Why Refrigeration Systems Present a Unique Cybersecurity Risk

Operational technology that controls physical processes like cooling systems is difficult to patch because updates often require shutting systems down, creating extreme risk in healthcare settings where even minutes of downtime threaten patient safety, NPR reported. Remote maintenance arrangements can also give outside contractors access to critical systems that an organization’s own security staff may not monitor, Ynetnews reported.

“Nobody treats the fridge as a cyber asset. It belongs to maintenance, not to IT,” said Segev Moyal of Profero, according to Ynetnews. “That’s exactly why this works.”

Questions Readers Ask About the Refrigeration Cyberattacks

How hot did the freezers get during the European attacks? Temperatures in affected cold storage units rose to 122 degrees Fahrenheit (50 degrees Celsius), according to Fox8 and The Guardian, causing food worth tens of millions of euros to spoil.

Were any blood products lost in the French attacks? No. The French Blood Establishment confirmed that while its surveillance systems were triggered and equipment taken offline, no blood products were lost, and samples were promptly moved to other facilities, Fox8 reported.

What should organizations do now? The FBI, CISA, HHS, and USDA urge organizations to eliminate public internet exposure of refrigeration controllers, isolate operational technology networks, enforce strong credential security, and install independent temperature alarms, according to the joint advisory and Ynetnews.

The incidents arrive as European officials confront a broader campaign of sabotage that includes drone incursions, damage to subsea cables, and disinformation operations, The Guardian reported, suggesting that refrigeration systems represent just one front in a widening pattern of infrastructure attacks.

More on this story: Cyberattacks targeting commercial refrigeration systems have disrupted operations across at least · Pentagon Investigates Military Commissary Freezer Failures as Possible Cyberattack