The key facts

  • CISA, the FBI, and the agriculture, health, and transportation departments warned of attacks on refrigeration and 'cold chain' systems in critical infrastructure
  • Waves of attacks affected at least a dozen countries, including the UK; some systems were Danfoss refrigerators without security updates
  • The US has not attributed the attacks, but researchers and, reportedly, officials point to Iran

What happened and what US authorities are saying

US agencies — CISA, the FBI, and the departments of Agriculture, Health and Human Services, and Transportation — in a joint statement on Thursday warned that hackers are breaking into internet-connected industrial refrigeration and cold chain monitoring systems in grocery stores and warehouses. Critical infrastructure is at risk: food production, agriculture, transportation, and medicine shipping. 'If successfully exploited, threat actors could alter temperatures and potentially cause physical consequences, such as fire hazards, loss of inventory, and reduced equipment lifespan,' the statement says. In a separate advisory the agencies specified that hackers can 'force units into continuous heating and defrost cycles, leading to mass inventory loss and equipment threats.' CISA's acting cyber chief Chris Butera urged 'every organization that relies on refrigeration and monitoring systems to consider themselves a potential target.'

The scale: supermarkets, military bases, a blood bank

The warning followed several waves of attacks on industrial refrigeration units in the UK and Europe in recent weeks. As TechCrunch reported, two separate waves of attacks allowed hackers to raise temperatures in freezers and refrigeration units in at least a dozen countries, spoiling thawed food. Some of the affected systems were remotely managed refrigerators made by Denmark's Danfoss, which stopped releasing security updates for customers' equipment. In addition, hackers attacked the French blood bank EFS, raising the temperature in units holding donor blood — the attack was stopped before the blood supplies were compromised, according to EFS. Separately, the US Department of Defense is investigating a series of freezer hacks at military bases, Reuters reports; they were first reported by the blog Signal and Silence.

Who is behind the attacks and what the agencies recommend

The US has not officially linked the attacks to a specific group or state, but security researchers broadly attribute them to Iran, and US officials, according to media reports, also consider Iran the likely culprit. The agencies recommended that affected industries disconnect remote management systems from the internet, change and strengthen passwords, install available patches, and decommission equipment that is no longer supported by the manufacturer. The practical takeaway of the warning: the vulnerability relates not only to specific products but also to the practice of leaving outdated refrigeration equipment with remote access connected to the network — and it was precisely such systems, according to TechCrunch, that were among those affected.