FBI, CISA warn of attacks targeting industrial refrigeration systems

Summary

The FBI, CISA and other agencies warn that attackers are targeting internet-accessible or unpatched refrigeration controllers. They recommend removing controllers from the public internet, securing remote access, applying updates and isolating operational technology.

Key points

• A joint agency advisory says attackers target unpatched or internet-accessible electronic temperature controllers and commercial refrigeration management systems.
• The advisory describes possible exploitation of authentication bypasses, arbitrary code injection flaws and weak configurations to alter temperature settings or force heating and defrost cycles.
• Agencies warn that attacks could spoil inventory, damage equipment, create fire hazards and obscure temperature problems.
• An October attack reportedly affected an estimated 250 to 350 French supermarkets; a November wave reportedly affected more than 115 stores across six European countries.
• The French Blood Establishment confirmed that an incident affecting a refrigeration equipment provider altered temperature and defrost settings at three blood-storage facilities.
• Recommended safeguards include removing controllers from the public internet, securing remote access, changing default passwords, applying available updates and isolating operational technology from business networks.

People

Industries