US government warns of ‘ongoing cyber threat’ amid mass hacks of industrial retail and military freezers

The U.S. government is warning of an “ongoing cyber threat” facing industrial refrigeration units, after reports of cyberattacks targeting freezers and fridges in supermarkets around the world, U.S. military bases, and at least one blood bank.

U.S. cybersecurity agency CISA, the FBI, and several other federal government departments warned in a joint statement on Thursday that hackers are targeting and compromising internet-connected refrigeration and cold chain monitoring systems in grocery stores and cold storage facilities. The statement said that the hacks are hitting critical infrastructure, such as the food, agriculture, transportation, and medicine-shipping industries.

“If successfully exploited, the actors could change the temperature and possibly cause physical impacts such as fire hazards, loss of inventory and changes to the service life of the system,” the agencies warn.

The warning comes after several waves of cyberattacks targeting industrial refrigeration units across the United Kingdom and Europe in recent weeks. Two separate waves of attacks allowed hackers to crank up the temperature on freezers and chilling units in at least a dozen countries, spoiling defrosted food and destroying produce. Some of the affected systems included remote-controlled refrigeration units made by Danish company Danfoss, which had stopped providing security updates to its customers’ freezers.

Hackers also targeted a blood bank in France, causing its refrigerated units to boost temperatures in its cold units containing donated blood supplies — but were stopped before the attack could compromise blood stores. The U.S. Department of Defense is investigating a spate of hacks targeting freezers run by the military, according to Reuters. The hacks were first reported by Signal and Silence.

The U.S. has not attributed the hacks to a particular group or government, but security researchers have broadly attributed the attacks to Iran; U.S. officials also reportedly suspect Iran is the likely culprit.

CISA, the FBI, and the Departments of Agriculture, Health and Human Services, and Transportation urged affected industries to remove remote control systems from the internet, change and strengthen passwords, apply patches where possible, and retire equipment that’s no longer supported by the vendor.

In a separate fact sheet, the departments said that hackers may attempt to “force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.”

“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said CISA’s acting cybersecurity chief Chris Butera.