US agencies warn grocers and cold-chain operators of global refrigeration hacking spree spoiling food, risking fires
The FBI, CISA, Health and Human Services, USDA, and the Department of Transportation issued a joint advisory on Thursday warning operators of industrial refrigeration and cold-chain monitoring systems about an ongoing wave of attacks. Since mid-October, unknown attackers have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden, forcing units to overheat to as high as 50°C (122°F), spoiling food and sparking fires. No confirmed attacks against US supermarkets have been documented, but Ahold Delhaize (parent of Food Lion, Giant Food, and Stop & Shop) proactively took IT systems offline last month after a cyberattack, and the Pentagon is reportedly investigating freezer malfunctions that spoiled food at US military bases in August as a suspected cyberattack.
Detalhes técnicos
According to the agencies, the actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards. The article states that attackers gain access by bypassing authentication, injecting arbitrary code, and abusing weak configurations, allowing them to change temperatures to spoil food or temperature-controlled medications, start fires, and potentially harm consumers of improperly stored products. No specific CVE or vulnerable vendor product was named in the advisory or the article; the threat is attributed to internet-exposed electronic temperature and commercial refrigeration controllers broadly, not a single named flaw. Separately, the agencies drew a parallel to Iranian hackers who used internet-accessible programmable logic controllers (PLCs) to breach more than 100 US water systems in July, citing exposed, often password-less devices as an easy entry point for attackers.
Remediação
The agencies urge owners and operators to immediately disconnect industrial control systems and devices from the public internet; if remote access is required, protect it behind a firewall or edge device kept up to date. Additional recommendations include creating a dedicated VLAN to isolate OT devices from business networks, replacing default passwords with strong, unique credentials and enabling phishing-resistant multi-factor authentication, applying patches promptly and retiring unsupported legacy devices, maintaining a device/IP allow-list restricting OT access, keeping offsite and offline backups, and enabling and regularly reviewing logs for unusual activity.
Linha do tempo
-
US agencies warn grocers and cold-chain operators of global refrigeration hacking spree spoiling food, risking fires
ler a análise desta fonte ocultar
The FBI, CISA, Health and Human Services, USDA, and the Department of Transportation issued a joint advisory on Thursday warning operators of industrial refrigeration and cold-chain monitoring systems about an ongoing wave of attacks. Since mid-October, unknown attackers have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden, forcing units to overheat to as high as 50°C (122°F), spoiling food and sparking fires. No confirmed attacks against US supermarkets have been documented, but Ahold Delhaize (parent of Food Lion, Giant Food, and Stop & Shop) proactively took IT systems offline last month after a cyberattack, and the Pentagon is reportedly investigating freezer malfunctions that spoiled food at US military bases in August as a suspected cyberattack.
Technical Details
According to the agencies, the actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards. The article states that attackers gain access by bypassing authentication, injecting arbitrary code, and abusing weak configurations, allowing them to change temperatures to spoil food or temperature-controlled medications, start fires, and potentially harm consumers of improperly stored products. No specific CVE or vulnerable vendor product was named in the advisory or the article; the threat is attributed to internet-exposed electronic temperature and commercial refrigeration controllers broadly, not a single named flaw. Separately, the agencies drew a parallel to Iranian hackers who used internet-accessible programmable logic controllers (PLCs) to breach more than 100 US water systems in July, citing exposed, often password-less devices as an easy entry point for attackers.
Remediation
The agencies urge owners and operators to immediately disconnect industrial control systems and devices from the public internet; if remote access is required, protect it behind a firewall or edge device kept up to date. Additional recommendations include creating a dedicated VLAN to isolate OT devices from business networks, replacing default passwords with strong, unique credentials and enabling phishing-resistant multi-factor authentication, applying patches promptly and retiring unsupported legacy devices, maintaining a device/IP allow-list restricting OT access, keeping offsite and offline backups, and enabling and regularly reviewing logs for unusual activity.