U.S. Government Tells Food Retailers to Take Refrigerators Off the Internet Due to Malicious Cyberattacks
Need to Know
- Following cyberattacks on refrigeration systems at hundreds of European grocery stores and suspected incidents at U.S. military commissaries, federal agencies have issued a cybersecurity advisory
- CISA, FBI, HHS, USDA, and DoT urged food and agriculture operators to strengthen protections for industrial refrigeration and cold chain monitoring systems
- Hackers may exploit outdated software, unpatched vulnerabilities, and internet-accessible refrigeration controllers to remotely manipulate temperatures, potentially causing food losses and safety risks
- Recommended cybersecurity measures include eliminating unnecessary internet exposure, isolating operational technology networks, strengthening authentication, updating firmware, restricting access, and maintaining reliable backups
- A source told Food Safety Magazine that independent temperature monitoring and alert systems can help grocers detect temperature abuse that compromised refrigeration controllers may fail to report, reducing potential food safety risks
Following two separate refrigerator cyberattacks in Europe, which affected hundreds of grocery stores, as well as a similar incident that impacted commissaries on U.S. military bases, U.S. government agencies are warning crucial industries, including food and agriculture, to take certain actions to protect their operations from future attacks.
The advisory was issued by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Federal Bureau of Investigation (FBI), the U.S. Department of Health and Human Services (HHS), the U.S. Department of Agriculture (USDA), and the U.S. Department of Transportation (DoT).
Citing “malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally,” the agencies urged owners and operators to defend against cyberattacks “by using strong authentication, keeping systems updated, identifying any systems that are accessible from the internet, removing unnecessary remote access, and securing any necessary remote access.”
“Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” said FBI Cyber Branch Operations Director Brett Leatherman. “We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk."
The agencies recommend industry immediately take the following actions:
- Eliminate public internet exposure, and if remote access is necessary, protect it by using a firewall or edge device and updating it to the latest version to reduce security vulnerabilities
- Isolate operational technology (OT) devices by creating a dedicated OT virtual local area network (VLAN) to separate OT devices from business networks
- Enforce credential security by changing default passwords, strengthening passwords, and implementing strong password policies, as well as implementing phishing-resistant multifactor authentication wherever feasible
- Apply patches to keep device firmware up to date and establish a structured lifecycle management process to identify, retire, and replace legacy devices that are at end of life (EOL) and no longer supported by the manufacturer
- Restrict access by defining and maintaining device and IP address allowlisting, limiting access to only those devices and IP addresses authorized to make changes
- Have reliable backups, maintaining current backups offsite and offline and testing them
- Monitor and report unexpected activity by enabling logging and regularly reviewing logs; for OT assets where logs are non-standard or not available, collect network traffic and communications between the assets
- Define and maintain reasonable setpoint limits for devices operating downstream of controllers to stay within safe ranges and establish alerting for deviations.
These recommendations align with the Cross-Sector Cybersecurity Performance Goals (CPGs), developed by CISA and the U.S. National Institute of Standards and Technology (NIST).
Recent Cyberattacks on Refrigeration Systems Worldwide
In October and November, European supermarkets were impacted by cyberattacks in which internet-connected refrigeration systems were infiltrated by hackers and temperatures were raised to as high as 50 °C overnight. Hundreds of locations were hit, resulting in massive food loss and waste, and some fires. National authorities concluded that these were malicious, targeted events.
As news of the cyberattacks in Europe surfaced, the U.S. Pentagon reported that it was investigating similar incidents that occurred at multiple American military base commissaries in August as potential malicious cyber events.
Looking for quick answers on food safety topics?
Try Ask FSM, our new smart AI search tool.
Ask FSM →
Organizations involved in the European incidents reported that hackers had taken advantage of vulnerable refrigeration systems running on outdated software.
The advisory from the U.S. government agencies echoed what is known about the European cyberattacks, saying, “The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles.”
Attackers may exploit vulnerabilities through authentication bypass, arbitrary code injection, or weak configurations, the U.S. agencies elaborated.
How Grocers Can Minimize Food Safety Risk in the Event of a Cyberattack
“The bigger risk [of these cyberattacks] may be food safety, not spoilage,” Todd Gebski, CEO of Ladle, said to Food Safety Magazine. If food products have not defrosted, retailers may not be aware that temperature abuse had occurred—posing a risk to consumers.
“If a case goes into defrost at 1 A.M. and recovers by 4 A.M., staff arriving at 6 A.M. will find product that looks and feels cold,” Mr. Gebski explained. “It may still have sat above safe temperatures for hours. Without an independent temperature record, there's no way to know.”
Mr. Gebski added that, in many of the stores that were hit, the refrigeration controllers targeted by the attackers were simultaneously the warning system meant to alert staff of an issue. He contrasted the massive food waste supermarkets experienced due to this vulnerability against the French Blood Establishment, the country’s national blood bank, which was also included in the latest wave of cyberattacks but had separate alarms that caught the change in temperature, allowing them to quickly respond and prevent losses.
Acknowledging that grocers cannot simply overhaul all their refrigeration systems overnight, Mr. Gebski suggested “quickly adding a second set of eyes” as a solution in the meantime. Specifically, food retailers can put wireless monitors in their cases, which can run independently of the refrigeration controls and connect over cellular rather than the store’s network, to alert staff when an issue arises.
Cybersecurity as a Food Safety Issue
To learn more about cybersecurity as an emerging and important food safety issue, explore Food Safety Magazine’s ongoing cybersecurity column series.
In an early entry from June 2022, authors Robert Norton, Ph.D., Auburn University Professor and National Security Liaison, and N.C. Simmons, a National Security Specialist, wrote:
“Cyber is the backbone for food and agriculture defense. Adversaries have the means, opportunity, and motivation to break the cyber backbone at will. Just because they have not done so, does not mean they will not in the future. If or when adversaries carry out an attack of large magnitude, the result could be a massive compromise of food safety, food defense, and food security. To avoid that dark scenario, agriculture and food companies must properly prepare for a different kind of assault. The place to start is with their own cyber defense systems.”
