Five federal agencies say the same weaknesses could hit American grocers, farms, hospitals and food processors. Here’s what to check.
Hackers have been reaching into European supermarkets and changing the settings on commercial refrigerators and freezers. Food has spoiled, and the attacks have reached facilities that store blood for France’s national blood service.
On Thursday, November 5, five U.S. agencies issued an unusual joint warning: CISA, the FBI, and the departments of Health and Human Services, Agriculture, and Transportation say the same weaknesses could threaten the refrigeration and cold-storage systems used by American grocers, farms, hospitals, food processors and trucking companies.
We found no reported Vermont cases. But a vulnerable controller reachable from the internet isn’t any safer because it sits in Vermont instead of France.
What happened in Europe?
In October, French police said hackers seized control of cooling units at hundreds of supermarkets, pushing temperatures as high as 122 degrees Fahrenheit and causing fires and food losses. A second wave hit stores in Sweden, the Netherlands, Belgium, Ireland, Luxembourg and Estonia on November 2. One Swedish grocer found its fridges and freezers set to 122 degrees, and a Belgian refrigeration company said the units had been switched into defrost mode (NBC News).
It wasn’t only groceries. In early November, attackers raised the temperature and defrost settings in cold-storage rooms at three facilities of France’s national blood service. According to The Record, the service’s monitoring caught it quickly, stored products were moved to other sites as a precaution, and no blood products were lost. The attackers got in through an outside refrigeration-equipment supplier, not the blood service’s own systems.
No one has been officially identified as responsible for the wider attacks, and not every reported incident necessarily has the same cause.
A refrigerator can be a computer with consequences
Commercial cooling equipment increasingly runs on network-connected controllers that track temperatures, schedule defrost cycles, change settings and alert technicians remotely. Those features are useful. But a controller that’s exposed to the internet, poorly secured or out of date can be a way in.
The federal advisory warns of flaws that let attackers skip the password entirely, run their own code, or exploit weak settings. A successful attack could change temperatures, force units into nonstop heating or defrost cycles, hide the real temperature readings, destroy inventory or create equipment hazards, including fire.
Unlike a data breach, this changes the physical conditions that keep food or medicine safe.
What Vermont businesses should do now
A grocery store, restaurant, dairy farm, butcher shop, pharmacy or any business that depends on refrigeration should start with one question for its refrigeration contractor: Can anyone reach our controller from the internet? Don’t assume the answer is no.
The federal agencies recommend:
- Get it off the open internet. Keep controller panels off the public internet. If a technician needs remote access, put it behind properly secured, up-to-date network protection instead of leaving the control panel reachable.
- Lock down the accounts. Replace default passwords, use unique strong ones, limit who can change settings, and turn on two-step login wherever it’s supported.
- Update or isolate old equipment. Install the manufacturer’s firmware fixes, and find any controllers that no longer get security updates. Keep equipment controls on a separate network from ordinary office computers.
- Check alarms and limits. Set sensible temperature and defrost limits, watch for unexpected changes, and make sure alarms reach someone who can respond. An independent thermometer or monitoring system is a valuable second line of defense.
- Be ready to recover. Keep backups of your settings, know whom to call, and make sure staff can run the equipment safely if remote monitoring goes down.
This isn’t just a matter of changing a password. Some of these flaws bypass the password entirely. Have a qualified technician make the changes so important alarms keep working.
What about homeowners?
The European attacks involve commercial equipment, not a wave of attacks on household refrigerators, ovens or thermostats. Still, the lesson applies at home to connected appliances, heating controls, cameras and garage-door openers: every internet feature you don’t need is one more thing to keep secure.
The Federal Trade Commission advises homeowners to change default passwords, keep device software updated and turn off remote-management features they don’t use. Its home Wi-Fi guide also recommends changing the router’s default settings, turning on its firewall and setting up a separate network for guests and devices.
A device on your home Wi-Fi isn’t automatically exposed to the whole internet. But cloud accounts and outdated devices can still be risks. If an appliance works fine without being online, consider turning off its internet connection, not its power or any safety monitoring.
The first call may be to your installer
If refrigeration settings change unexpectedly, check temperatures with an independent thermometer, protect inventory that may be affected, and call your equipment service company. Don’t assume food or medicine stayed safe just because the display later reads normal again.
Businesses that suspect a cyber intrusion can report it to CISA, by email at contact@cisa.dhs.gov or at 1-844-729-2472, or to the FBI’s Internet Crime Complaint Center.
There’s no known Vermont attack in this story. There is a documented threat overseas and a fresh warning from five federal agencies. For any Vermonter whose living depends on a machine keeping something cold, the practical question is whether that machine really needs to be reachable from outside the building, and who has the keys if it is.