-
Five U.S. agencies say hackers are going after the controls that keep food and medicine cold. They can make a unit heat up instead of cool down.
-
Hackers have spoiled food at hundreds of European stores. The Pentagon is also checking August freezer failures at U.S. military stores, but no cause is confirmed.
-
The warning names no group, brand or software bug. The fixes are simple: get controls off the public internet, change default passwords and replace old devices.
On Thursday, five federal agencies sent out a joint warning about hackers going after the systems that keep food and medicine cold. The FBI, CISA, and the Departments of Health, Agriculture, and Transportation all signed the alert.
Dated November 5, the joint advisory says the threat is ongoing and happening around the world. However, it does not describe a specific new attack in the United States.
Details of the Campaign
The warning isn’t just for grocery stores or cold storage sites as well as hospitals, chemical companies, farms, and shipping companies that rely on temperature control systems. These devices manage heat levels, power usage, as well as run defrost cycles.
The agencies list three ways in. Hackers can dodge the login screen, slide in their own code, or exploit weak settings. Devices that haven’t been updated or are open on the internet are especially at risk.
Once inside, hackers can change the settings. For example, they can force a unit into nonstop heating and defrost cycles. That can ruin stock, wear out equipment and start fires.
Shoppers could also get sick if stores sell food that sat at unsafe temperatures. Hackers can even hide the readings, which the agencies call a “denial-of-view” problem. Staff then cannot tell that something is wrong.
The Hackers Target Stores Across Europe
On the night of October 11, hackers took over cooling controls at hundreds of French grocery stores. Intermarché said its units heated to as much as 122°F. Stores tossed food, and some units caught fire. The head of Intermarché’s parent company expected losses in the tens of millions of euros.
A second wave hit on November 2. Stores in Belgium, Sweden, Estonia, Ireland, Luxembourg and the Netherlands reported warm fridges and freezers. Delhaize said an IT problem hit several dozen of its stores. SuperValu in Ireland pulled chilled and frozen goods from 13 of its 223 stores. One Swedish store said its units jumped to 122°F, while a butcher in Athens told Greek TV that his unit reached 302°F.
Medical supplies were at risk too. A cooling-equipment provider for the French Blood Establishment had an incident on Monday. It touched cold storage at three sites. Media reports say hackers tried to push settings from about -22°F to 230°F. The blood service says its alarms caught the changes fast, so it lost no blood products and saw no health impact.
The Known U.S. Incident
The U.S. picture is less clear. Reuters reported last week that the Pentagon treats August freezer failures as a suspected cyberattack. At least six military grocery stores had failures that spoiled food. Fort Huachuca in Arizona said its freezers went into defrost mode. Officials have not named a cause, and Reuters could not learn which brand the bases use.
Meanwhile, The Register said it knows of no confirmed attacks on American grocery stores. The FBI had not answered its questions by publication time.
Who is Behind the Hacking Campaign
Nobody has claimed the attacks. The advisory names no group, maker or software flaw. Belgium’s cyber center said it may never learn who did it. Prosecutors in Paris and Belgium have opened probes. Similar methods do not prove that one group is behind every case.
Cyberattacks on critical infrastructure have also raised concerns elsewhere worldwide, including a recent hacker claim of stealing 890GB of data from an Iranian nuclear facility following an attack on Bushehr.
Officials do point to basic weaknesses, though. France’s cyber agency found hacked Danfoss and Copeland controls and told owners to unplug them or tightly limit access. Danfoss said most affected French units were older models that no longer get security updates.
In the Netherlands, it added, the hit units still used default passwords. Britain’s cyber center said the French fridges sat on the internet with default passwords. A Darktrace executive agreed that hackers needed no brand-new flaw.
What Operators Should Do
The agencies urge owners to act right away. First, take controls off the public internet. If remote access is a must, protect it with an updated firewall. Next, put these devices on a separate network from office systems. Then change default passwords and use phishing-resistant, multi-step login where possible.
Also update device software, and replace gear that the maker no longer supports. Limit access to approved devices and addresses, because that blocks strangers. Finally, keep tested offline backups, turn on logs, and set safe temperature limits with alerts for odd changes.
U.S. groups should report suspicious activity to CISA at 1-844-729-2472 or to the FBI’s Internet Crime Complaint Center. HHS offers help with health care disruptions at 202-619-7800.
FBI official Brett Leatherman said the sheet gives practical ways to cut the risk. CISA’s Chris Butera said every group that relies on these systems “should assume it could be a target.”
