The federal government has issued a joint warning to businesses regarding potential cyberattacks targeting industrial refrigeration systems. Five agencies stated that attackers have already exploited vulnerabilities in European systems to remotely alter temperatures, leading to inventory loss and safety risks.
The alert follows reports of similar refrigeration outages at six U.S. military bases in August. The Department of the Army Criminal Investigation Division is investigating those incidents. While the federal notice highlights global threats, officials did not specify whether any private U.S. businesses have been successfully targeted yet.
According to a joint statement from the Cybersecurity and Infrastructure Security Agency (CISA) and four other departments, hackers are targeting systems that are connected to the internet or running unpatched software. Reported incidents in Luxembourg, Belgium, and Sweden resulted in food spoilage at grocery chains after temperatures spiked unexpectedly. In France, officials reported that hackers attempted to raise temperatures at several blood banks within the national emergency blood supply network.
CISA, the FBI, and the departments of Health and Human Services, Agriculture, and Transportation recommended that organizations disconnect refrigeration devices from the internet. They also urged businesses to change default passwords and apply software updates to close known security gaps. Joshua Corman of the Institute for Security and Technology stated that the limited number of industrial refrigeration providers means many systems likely share the same vulnerabilities.
For a business or hospital, the concrete day-to-day change involves an auditing of cooling hardware for internet connectivity. A successful breach could lead to the loss of food or medical inventory, or in extreme cases, create fire hazards. These impacts would be noticed through unexpected temperature alerts or physical system failures.
The knock-on effects could disrupt the stability of food and medical supply chains if bulk warehouses or labs are targeted. Federal investigators are looking into the August military base outages. Organizations are encouraged to implement the recommended security patches and password changes to prevent future unauthorized access. No specific deadline for compliance was reported, as the measures are recommendations rather than mandates.