CISA, FBI warn on industrial refrigeration attacks after Danfoss-linked supermarket and French blood-service cold-storage intrusions
On November 5, CISA, the FBI and three other US federal agencies warned operators to secure industrial refrigeration and cold-chain monitoring systems. The warning follows attacks on supermarket refrigeration systems in Europe, including at least 17 mostly small businesses in the Netherlands on November 2. France's national blood service also confirmed that monitoring and control systems at three cold-storage sites were affected. Staff intervened before any blood products or samples were compromised. The article names no threat actor, malware or CVE. This summary draws on the article alone, and no web research was done.
Detalhes técnicos
- Danfoss said the affected systems were reachable through unsecured connections and used default passwords (per NOS, cited by malwarebytes.com).
- The agencies warn that attackers may exploit authentication bypass flaws, code-injection vulnerabilities or weak configurations in refrigeration controllers. Successful attacks could change temperatures or force equipment into continuous heating or defrost cycles.
- Danfoss told Dutch customers on October 13, after the first attacks in France, to disconnect systems from the public internet. Most stores followed the advice, and major Dutch chains were reportedly unaffected.
Remediação
- Keep control panels off the public internet and isolate operational equipment from business networks.
- Change default passwords and use strong authentication.
- Patch firmware and replace unsupported devices.
- Set safe operating limits, with alerts for temperatures outside them.
Linha do tempo
-
CISA, FBI warn on industrial refrigeration attacks after Danfoss-linked supermarket and French blood-service cold-storage intrusions
ler a análise desta fonte ocultar
On November 5, CISA, the FBI and three other US federal agencies warned operators to secure industrial refrigeration and cold-chain monitoring systems. The warning follows attacks on supermarket refrigeration systems in Europe, including at least 17 mostly small businesses in the Netherlands on November 2. France's national blood service also confirmed that monitoring and control systems at three cold-storage sites were affected. Staff intervened before any blood products or samples were compromised. The article names no threat actor, malware or CVE. This summary draws on the article alone, and no web research was done.
Technical Details
- Danfoss said the affected systems were reachable through unsecured connections and used default passwords (per NOS, cited by malwarebytes.com).
- The agencies warn that attackers may exploit authentication bypass flaws, code-injection vulnerabilities or weak configurations in refrigeration controllers. Successful attacks could change temperatures or force equipment into continuous heating or defrost cycles.
- Danfoss told Dutch customers on October 13, after the first attacks in France, to disconnect systems from the public internet. Most stores followed the advice, and major Dutch chains were reportedly unaffected.
Remediation
- Keep control panels off the public internet and isolate operational equipment from business networks.
- Change default passwords and use strong authentication.
- Patch firmware and replace unsupported devices.
- Set safe operating limits, with alerts for temperatures outside them.