The FBI and CISA say hackers are changing temperatures on commercial freezers and coolers, and businesses that use remote cooling controls should check them now.
US agencies are warning that hackers are actively breaking into the controls that run commercial freezers and coolers. The FBI and CISA, the federal cyber defense agency, say attackers are changing temperature settings, which can spoil food, damage equipment and even start fires. The warning also came from the health, agriculture and transportation departments.
The agencies say attackers are going after electronic temperature controllers and refrigeration management systems that are out of date or reachable from the internet. These devices let staff check temperatures remotely, manage defrost cycles and control cooling equipment.
Hackers can bypass logins, inject their own code or take advantage of weak settings. Then they can force equipment into nonstop heating or defrost cycles. They may also hide the real temperatures, so staff do not notice a problem until it is too late.
The US warning follows attacks in Europe. In October, hackers got into refrigeration controllers at an estimated 250 to 350 French supermarkets. They switched on defrost functions and raised temperatures in fridges and freezers.
A second wave in November hit more than 115 stores in six European countries. Some systems shut down entirely. Others heated up to 50°C (122°F). On November 3, the French Blood Establishment confirmed that an incident at a refrigeration equipment provider changed temperature and defrost settings at three sites that store blood products.
The agencies point to grocery stores, cold storage sites, food producers, healthcare facilities, chemical facilities and transportation firms. A restaurant or small shop with remote-access cooling controls could be exposed too. CISA's Chris Butera said every organization that depends on these systems should assume it could be a target.
Who can relax a little? The warning is about commercial and industrial equipment. Home refrigerators are not mentioned. Businesses whose controllers cannot be reached from the internet and are fully updated face less of the risk the agencies describe.
The steps are in the alert box above. The first move is simple to ask about: find out whether your cooling controls can be reached online, and call your equipment vendor or service company to ask about security updates.
The agencies call the threat ongoing. The material does not say who is behind the attacks or how many US sites, if any, have been hit. Expect more guidance from equipment makers, and watch for news from your own vendor.
If your business runs cooling controls that can be reached online, ask your vendor today about updates and take them off the public internet.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
