US Agencies Urge Organizations to Secure Refrigeration Controllers
Summary
US agencies warn that attackers are targeting refrigeration controllers. Censys found 3,124 of 6,695 identified internet-exposed controllers still accessible on November 5. Agencies recommend removing systems from the internet or adding safeguards.
Key points
- US agencies say malicious actors are targeting electronic temperature and commercial refrigeration controllers in retail grocery and cold-storage facilities.
- The article reports attacks that altered refrigerator and freezer settings at supermarkets, spoiling food and sometimes causing fires; a blood bank avoided losses after staff acted quickly.
- Noname057(16) and Z-Pentest Alliance reportedly claimed hacking Danfoss, but their responsibility for the supermarket attacks is unconfirmed; other possible perpetrators are mentioned.
- The agencies warn that attackers may exploit vulnerabilities, weak configurations, authentication bypasses or code injection to alter settings or cause denial of view.
- Censys reported that 3,124 of 6,695 identified internet-exposed controllers remained accessible on November 5. XWEB exposure fell 35%, and StoreView exposure fell 76%.
- Agencies recommend taking controllers off the internet where possible; otherwise, use a firewall or edge device, isolate OT devices, restrict access, use strong passwords and phishing-resistant MFA, update systems, keep offsite backups, and enable logging and monitoring.
Article Details
- Event Type
- Reported cyberattacks on industrial refrigeration and cold-chain monitoring systems, alongside a US government warning and hardening recommendations.
- Impact
- Attackers reportedly altered refrigerator and freezer settings at hundreds of supermarkets, spoiling food and causing fires, with losses reported in the millions. A second wave affected more than 100 supermarkets and a blood bank; staff action reportedly prevented compromise of blood products and samples. The agencies warned that attacks could cause inventory losses and equipment hazards.
Threat Actors
NoName057(16)Reportedly claimed hacking Danfoss; the group was speculated to be behind the supermarket attacks, but that involvement has not been confirmed.Z-Pentest AllianceReportedly claimed hacking Danfoss; the group was speculated to be behind the supermarket attacks, but that involvement has not been confirmed.
Vendors
Copeland/DixellThe company’s analysis covers the widely used Copeland/Dixell XWEB and Danfoss StoreView controllers: XWEB exposure dropped 35% (3,708 to 2,420), while StoreView dropped 76% (3,004 to 708).DanfossRussian hacktivist groups such as Noname057(16) and Z-Pentest Alliance reportedly claimed hacking Danfoss, leading to speculation that they mounted the supermarket attacks.
Products
StoreViewThe company’s analysis covers the widely used Copeland/Dixell XWEB and Danfoss StoreView controllers: XWEB exposure dropped 35% (3,708 to 2,420), while StoreView dropped 76% (3,004 to 708).XWEBThe company’s analysis covers the widely used Copeland/Dixell XWEB and Danfoss StoreView controllers: XWEB exposure dropped 35% (3,708 to 2,420), while StoreView dropped 76% (3,004 to 708).
Industries
ChemicalThe US government is urging healthcare, chemical, food, and transportation organizations to harden their industrial refrigeration and cold chain monitoring systems.FoodThe US government is urging healthcare, chemical, food, and transportation organizations to harden their industrial refrigeration and cold chain monitoring systems.HealthcareThe US government is urging healthcare, chemical, food, and transportation organizations to harden their industrial refrigeration and cold chain monitoring systems.RetailCISA, the FBI, HHS, USDA, and DoT say they “are aware of malicious cyber actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities.”TransportationThe US government is urging healthcare, chemical, food, and transportation organizations to harden their industrial refrigeration and cold chain monitoring systems.