U.S. agencies say hackers are changing settings on internet-connected refrigeration controllers, spoiling food and risking equipment damage. Here is who should check.
Hackers are breaking into the control systems behind commercial freezers and coolers and pushing the temperature up. U.S. agencies, including the FBI and CISA, issued a joint warning that the attacks are active and global. The goal appears to be disrupted service, fire hazards and lost inventory.
In recent weeks, attackers hit hundreds of supermarkets across Europe. They reached refrigeration controllers that were open to the internet. Some units were heated to as high as 50 degrees Celsius (122 degrees Fahrenheit). Others were forced into defrost mode. Targets ranged from big chains to small grocers and butchers in countries including Belgium, France, Germany, Ireland, Italy and the U.K.
The French Blood Establishment confirmed that an incident at a refrigeration equipment provider pushed temperature and defrost settings to "extremely high levels" at three sites that store blood plasma.
The agencies say attackers are likely to use three routes: bypassing the login, injecting their own code, and taking advantage of weak setups. Weak setups include unchanged default passwords. The advisory warns that unpatched or internet-accessible controllers can be told to run continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.
Anyone who stores food, medicine or other temperature-sensitive goods with connected controllers should pay attention. That includes supermarkets, grocers, butchers and medical storage. Two products appear in the research: Danfoss StoreView and Copeland/Dixell XWEB. Censys, a firm that tracks devices visible online, counted 708 exposed StoreView systems on November 5, down from 3,004 on October 9. Most are in France. Exposed XWEB systems fell from 3,708 to 2,420.
Those numbers are falling, but hundreds to thousands are still reachable. A controller that cannot be reached from the internet is far less exposed to this kind of attack, so owners with fully local systems have less to worry about.
The steps in the alert box above cover the basics. Start by asking your refrigeration installer or service provider which of your units connect online, since many owners do not know. The FBI's Brett Leatherman said these systems are being targeted across critical infrastructure sectors, putting inventory and equipment at risk.
It is unclear who is behind the attacks. The material does not describe confirmed attacks in the U.S., though Censys says North America accounts for roughly 38% of global exposure of industrial control systems. Censys also links these cases to other recent attacks on gas station tank gauges, air raid systems and water towers.
If your coolers or freezers can be controlled online, find out now who can reach them, change default passwords and install updates.
A SonicWall remote access flaw may let someone get around extra login protection, and the US government says it may already be used in attacks.
Read more: US agency warns of a flaw that lets attackers skip a login checkPolice in Southampton say scammers are posing as Amazon and pressing people to share screens or send money. Here is how the trick works and what to watch for.
Read more: Fake Amazon calls and texts are tricking people out of thousandsA real £100 energy bill payment is coming, but applications are not open. Texts and emails offering a way to claim it are scams, a council warns.
Read more: Fake texts offer a £100 energy bill payment that isn't open yet
