The United States government has issued a warning to healthcare, chemical, food, and transportation sectors to enhance the security of their industrial refrigeration and cold storage monitoring systems. This comes in response to a series of cyber-attacks that have targeted these systems, with significant disruptions reported across Europe.
Recent Cyber Attacks on Refrigeration Systems
In recent weeks, malicious actors have successfully breached monitoring systems, manipulating temperatures in fridges and freezers. This has led to substantial financial losses for supermarkets and blood banks. On October 11, hundreds of supermarkets were impacted as hackers raised fridge temperatures to 50 degrees Celsius (122 degrees Fahrenheit) and initiated defrost cycles in freezers, leading to food spoilage and even fires in some instances.
Response and Speculation on Culprits
A subsequent wave of attacks affected over 100 supermarkets and a blood bank. However, only the supermarkets reported losses due to swift intervention by staff, which prevented damage to blood products, according to the French Blood Establishment (EFS). Speculations regarding the perpetrators point towards Russian hacktivist groups like Noname057(16) and Z-Pentest Alliance, though no concrete evidence has been confirmed. The BBC has also suggested that Iranian hacktivists or state-sponsored entities could be involved.
Official Recommendations and Precautionary Measures
The Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, HHS, USDA, and DoT, have acknowledged the threat posed by cyber actors targeting electronic temperature controllers in retail and cold storage facilities. These actors may exploit vulnerabilities to manipulate settings, causing extensive inventory losses and equipment hazards.
According to Censys, an internet intelligence firm, of the 6,695 refrigeration controllers identified online on October 9, only 3,124 remain accessible as of November 5. This includes a significant decrease in exposure for Copeland/Dixell XWEB and Danfoss StoreView controllers.
To mitigate these risks, US agencies recommend disconnecting control systems from the internet where possible. If online access is necessary, protecting these systems with firewalls or edge devices is advised. Additionally, organizations should isolate their OT devices, limit system access to trusted identities, implement strong password policies and multifactor authentication, and ensure systems are up-to-date with regular backups and monitoring.
By adhering to these guidelines, organizations can significantly reduce their exposure to cyber threats and safeguard their refrigeration and cold chain systems from being compromised.
