US agencies warn of ongoing hacks targeting industrial freezers

The agencies say hackers have broken into refrigeration systems in grocery stores and cold storage facilities, hitting critical infrastructure spanning food, agriculture, transportation and medicine shipping. If successfully exploited, they warn, attackers could alter temperatures and "possibly cause physical impacts such as fire hazards, loss of inventory and changes to the service life of the system."

Two separate waves of attacks let hackers raise the temperature on freezers and chilling units in at least a dozen countries, spoiling defrosted food and destroying produce. Some affected systems were remote-controlled units made by Danish company Danfoss, which had stopped providing security updates for its customers' freezers. In France, attackers targeted a blood bank and raised temperatures in units holding donated blood, but were stopped before supplies were compromised. Reuters reports that the US Department of Defense is investigating hacks targeting freezers run by the military.

The US government has not attributed the attacks to any particular group, though security researchers have broadly attributed them to Iran, and US officials reportedly suspect Iran is the likely culprit. The agencies urged affected industries to take remote control systems off the internet, improve password security, install patches where possible and decommission kit whose vendor no longer supports it. A separate fact sheet warned that hackers may force units into continuous heating and defrost cycles, which can lead to large-scale stock losses and dangerous equipment faults. "Every organization that depends on refrigeration and monitoring systems should assume it could be a target," said CISA's acting cybersecurity chief Chris Butera.