US agencies warn of ongoing cyber threat to industrial refrigeration

U.S. agencies are warning of an ongoing cyber threat to internet-connected refrigeration and cold-chain monitoring systems used by grocery stores and cold-storage facilities.

In a joint statement on Thursday, CISA, the FBI, and other federal departments said attackers are targeting and compromising these systems. The agencies said affected critical infrastructure includes food, agriculture, transportation, and medicine shipping.

The warning follows reports of cyberattacks on industrial refrigeration units in the United Kingdom and Europe in recent weeks. Two waves of attacks reportedly raised temperatures in freezers and chilling units in at least a dozen countries, spoiling food and destroying produce. Attackers also targeted a blood bank in France, but were stopped before donated blood supplies were compromised. The U.S. Department of Defense is investigating hacks of military-run freezers, according to Reuters.

The U.S. has not attributed the attacks to a group or government. Security researchers have broadly attributed them to Iran, and U.S. officials reportedly suspect Iran may be responsible.

The agencies warned that attackers could alter temperatures, creating fire hazards, inventory losses, and equipment risks. CISA acting cybersecurity chief Chris Butera said organizations relying on refrigeration and monitoring systems should assume they could be targets. The agencies urged affected organizations to remove remote-control systems from the internet, strengthen passwords, apply available patches, and retire equipment no longer supported by its vendor.