On November 5, various government agencies in the United States issued a joint statement warning that industrial refrigeration and cold chain monitoring systems are facing “ongoing cyber threats.” The agencies called on all organizations that rely on cold storage to immediately enhance their cybersecurity defenses.
This statement, released by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), the United States Department of Agriculture (USDA), and the Department of Transportation (DOT), outlined critical vulnerabilities in electronic temperature and commercial refrigeration controllers within retail grocery stores and cold storage facilities. The report emphasized that these vulnerabilities, particularly those that are unpatched or internet-connected, pose a significant threat to essential infrastructure spanning healthcare and public health, food and agriculture, chemicals, and transportation sectors.
The announcement highlighted the serious consequences if these vulnerabilities are successfully exploited, warning that “attackers could potentially alter temperatures and could trigger physical impacts, such as fire hazards, loss of inventory, and changes to equipment lifespans.”
The risks associated with compromising cold chain systems have already manifested in real incidents. For example, SuperValu, the third largest supermarket chain in Ireland, disclosed that 13 of its 223 stores experienced issues with specific models of refrigeration systems due to a cyber incident, resulting in the urgent removal of a significant amount of cold and frozen products from sale.
In response to these threats, Chris Butera, the acting deputy executive assistant director of cybersecurity at CISA, stressed the importance of collaborative efforts with government, industry, and international partners to actively monitor these threat activities. He urged all organizations relying on refrigeration and monitoring systems to assume they may become targets. Butera encouraged everyone to review the joint fact sheet and take immediate action to patch known security vulnerabilities.
Brett Leatherman, the acting head of the FBI’s Cyber Division, also raised alarms regarding the critical nature of industrial refrigeration and cold chain monitoring systems. Due to their role in protecting temperature-sensitive products such as food and pharmaceuticals, these systems have become prime targets for malicious hackers. Relevant equipment in the global critical infrastructure space is under assault, which threatens the safety of both inventory and systems.
Leatherman noted that the fact sheet provides actionable steps for cybersecurity defenders to mitigate risks and protect operations. He emphasized, “The FBI urges all organizations that depend on these systems to review our guidelines, implement recommended mitigation measures, and report any suspicious activity to the FBI.”
Officials have advised organizations to adopt several key mitigation measures, including disconnecting control system devices from the internet, changing default passwords and strengthening password protocols, timely patching to keep systems updated, and phasing out and replacing outdated equipment from vendors that no longer provide support.
By taking these steps, organizations can bolster their defenses against potential cyber threats, safeguarding not only their operations but also public health and safety. In a world increasingly reliant on technology, vigilance and proactive measures are more crucial than ever.