Feds warn grocers: Don't chill on cyber defenses as freezer hacking spree heats up

“We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk,” FBI Cyber Branch Operations Director Brett Leatherman said in a statement.

Since mid-October, unknown miscreants have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden. The attacks increase the temperature inside fridges to highs of 50ºC (122°F), spoiling food, and sparking fires.

The Register asked the FBI if it has documented any successful or attempted attacks against refrigeration and cold chain monitoring systems in America. We had not received a response to our questions at the time of publication, nor are we aware of any documented digital attacks against these systems in American supermarkets.

But there are signs that stateside operators are aware of the issue.

Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, last month said it proactively took IT systems offline following a cyberattack that affected most of its US and European brands.

Delhaize supermarkets in Europe are among those hit by the destructive freezer attacks.

The Pentagon is also reportedly treating a series of freezer malfunctions that spoiled food at military bases across the US in August as a suspected cyberattack, according to Reuters, which cited four officials familiar with the matter.

In a Thursday advisory, the US FBI, Cybersecurity and Infrastructure Security Agency (CISA), Health and Human Services, and departments of Agriculture and Transportation warned organizations about the ongoing cyber threats facing operators of industrial refrigeration and cold-chain monitoring systems.

“The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards,” the agencies said.

Attackers exploit these flaws by bypassing authentication, injecting arbitrary code, and abusing weak configurations, according to the feds. Once criminals gain access to the systems, they can change the temperature to spoil food or temperature-controlled medications, start fires, and ultimately harm people who consume products that haven’t been stored at proper temperatures.

How to stay frosty

To prevent these scenarios, the government organizations urge owners and operators to “immediately” implement best practices and security protections. First and foremost on the list: do not expose industrial control systems and devices to the public internet.

Iranian hackers used internet-accessible programmable logic controllers (PLCs) to break into more than 100 US water systems in July. This sort of exposed device, which often lacks password protection, is a boon to miscreants looking for an easy button to gain access to critical facilities.

“Should remote access be necessary, protect it by using a firewall or edge device and updating it to the latest version to reduce security vulnerabilities,” the feds advise.

Other recommended tactics include:

• Create a dedicated VLAN for operational technology (OT) devices, to isolate industrial devices from business networks.

• Replace default passwords with strong passwords and policies, turning on phishing-resistant multifactor authentication (MFA) whenever possible.

• Apply patches in a timely manner, and retire and replace legacy devices that no longer receive security updates from the manufacturer.

• Define and maintain a device and IP allow-list, and limit access to OT devices to only those on the list.

• Maintain and test backups. These should be kept offsite and offline.

And finally: enable logging and regularly review logs for any unusual activity.®