The FBI, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services, the Department of Agriculture, and the Department of Transportation have jointly warned supermarkets and other operators of refrigeration systems to take immediate steps to secure their installations.
The advisory (pdf) was prompted by recent attacks against European supermarket cooling systems. In those incidents, the targeted systems were directly accessible from the internet, used default passwords, and had not received important security updates.
Attackers changed the temperature settings of the refrigeration units, resulting in widespread spoilage and forcing supermarkets to discard large volumes of food. The agencies note that similar compromises could shorten equipment lifespan, cause fires, or lead to foodborne illness if spoiled products reach consumers.
Organizations are instructed to implement several measures without delay:
- Ensure that refrigeration control systems are not directly reachable from the internet.
- Segment OT systems onto a separate VLAN.
- Replace all default passwords with strong, unique credentials.
- Install available security patches immediately.
- Monitor systems continuously for signs of unauthorized access or unusual activity.
The agencies emphasize that these basic controls are essential to prevent further disruption to food supply chains and critical infrastructure.
