FBI Tells Grocers to Pull Freezer Controls Off the Internet

Five federal agencies told operators of industrial freezers and refrigerators on Nov. 5 to disconnect the controls from the public internet, warning that hackers are breaking into those systems and raising the temperature inside.

The joint advisory came from the FBI, the Cybersecurity and Infrastructure Security Agency, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation. It describes an ongoing cyber threat to industrial refrigeration and cold chain monitoring systems, the equipment grocery stores and cold storage warehouses use to log temperatures, run defrost cycles and hold down energy use.

"If successfully exploited, the actors could change the temperature and possibly cause physical impacts such as fire hazards, loss of inventory and changes to the service life of the system," the agencies wrote.

The notice does not say who is behind the attacks.

Fire hazards, spoiled stock and a blind spot

Attackers are going after electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage sites, the agencies said, hunting for units that are unpatched or reachable from the internet. Routes in include bypassing authentication, injecting arbitrary code and taking advantage of weak configurations.

Once inside, the temperature setting can be changed remotely. The agencies' fact sheet says the actors may "force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards."

Staff can also be cut off from seeing what is going on inside the cases. The agencies call that a denial-of-view condition, where the current temperature simply cannot be read on the monitoring console. A freezer full of ruined product can look fine on the screen until someone opens the door.

Thousands of systems, hundreds of stores

Since mid-October, unknown attackers have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg and Sweden. Temperatures inside the units reached highs of 50 degrees Celsius, or 122 degrees Fahrenheit, spoiling food and sparking fires.

France took the worst of it first. An attack on October 12 caused refrigerators to defrost at Intermarché and Coopérative U stores, with between 150 and 200 Intermarché locations hit along with nearly 100 Coopérative U outlets. One retailer put the losses at tens of millions of euros. BFM TV reported that rival chain E. Leclerc was also affected, with hackers remotely triggering forced defrosting in many stores.

A second wave hit more than 100 stores across Europe on Nov. 2, raising fridge temperatures at retailers in Sweden, Belgium, Luxembourg and elsewhere and forcing staff to throw out food. Later reports added Finland, Ireland, Estonia and the Netherlands to the list. Two separate waves have let hackers turn up the heat in at least a dozen countries.

Irish supermarket chain SuperValu said on Nov. 2 that refrigeration systems of one specific model were affected in 13 of its 223 stores. Chilled and frozen products were removed from sale.

Six commissaries and a Pentagon investigation

Freezers started failing at military commissaries across the United States around late August, affecting roughly six of the on-base grocery stores that serve service members and their families. U.S. officials suspect Iran-linked hackers were behind those malfunctions.

Reuters reported that the Pentagon is treating the incidents as a possible cyberattack, citing four officials familiar with the matter. In at least one case, the units were set to a higher temperature overnight rather than simply shutting off. A cyberattack has not been formally established as the cause.

Fort Huachuca in Arizona and Fort Irwin in California were among the sites with refrigeration failures. Fort Irwin limited commissary sales to dry goods after its units went down. The Army Criminal Investigation Division's Cyber Field Office is working with the Defense Commissary Agency and the Defense Criminal Investigative Service to figure out what happened, and investigators have been in contact with French law enforcement about whether the American failures connect to the European outages.

Nobody official has named the hackers

The United States has not attributed the attacks to any group or government. Some security researchers have pointed to Iran, and U.S. officials reportedly suspect Iran is the likely culprit. One security firm has instead pointed to Russia for the European attacks.

There is recent precedent for the method. In July, hackers targeted more than 100 U.S. water systems through internet-exposed programmable logic controllers, CISA said, and U.S. officials suspected Iran. Those devices often lack password protection, The Register reported.

Nahman Khayet, co-founder and CEO at Alt Security, said the freezer hacks follow a pattern closely aligned with Iranian operators. "They've been playing this game for many years," he told Nextgov/FCW.

The freezer nobody ever patched

Walk-in freezers and supermarket cases do not get replaced on a tech refresh cycle. They sit there for years, full of product, doing one job.

"Think about how hard it is to replace those refrigerators, right? They're huge things. It's very costly. And also you don't want to do any disruption to those because they probably hold a lot of items which are important, like food," Khayet said. That dynamic makes it unlikely the devices are getting the latest security updates, a gap Iranian cyber operators have often used to get inside critical infrastructure, he added.

Some of the affected systems in Europe were older remote-controlled refrigeration units made by the Danish company Danfoss, models the company no longer updates.

No American supermarket has been confirmed hit

The Register said it was aware of no documented digital attacks against refrigeration and cold chain monitoring systems in U.S. supermarkets. The advisory is a warning, not a report of damage on American shelves.

Operators here are paying attention anyway. Dutch grocery giant Ahold Delhaize, which runs Food Lion, Giant Food and Stop & Shop in the United States, said in October it proactively took IT systems offline following a cyberattack that affected most of its U.S. and European brands. Delhaize supermarkets in Europe are among the stores hit by the freezer attacks. The Dutch National Cyber Security Centre said it saw no reason to link Ahold's IT incident to the freezer attacks.

The checklist the government wants done now

The agencies told owners and operators to act immediately, and the first item is blunt: do not expose industrial control systems and devices to the public internet. Where remote access is genuinely needed, it should sit behind a firewall or edge device updated to its latest version.

The rest of the list reads like basic hygiene that plenty of stores have never done. Put operational technology devices on a dedicated VLAN so they are isolated from business networks. Replace default passwords with strong ones and turn on phishing-resistant multifactor authentication where possible. Apply patches promptly. Retire and replace legacy devices the manufacturer no longer supports. Keep a device and IP allow-list and limit access to the machines on it. Maintain tested backups, kept offsite and offline. Turn on logging and actually read it.

One recommendation is specific to cooling. Operators are told to define reasonable setpoint limits for devices downstream of the controllers so temperatures stay inside a safe range, and to set alerts for any deviation.

"The FBI urges every organization that relies on these systems to review our guidance, implement the recommended mitigations, and report any suspicious activity to the FBI," said Brett Leatherman, operations director of the FBI's Cyber Branch.

Blood banks, hospitals and refrigerated trucks

Hackers targeted refrigeration at three plasma storage sites used by France's blood service overnight Nov. 1 into Nov. 2. The French Blood Establishment, known as EFS, confirmed a temperature spike in the cold rooms after one of its refrigeration equipment providers was hit. No blood products were lost, EFS said.

Supermarkets are only one slice of the exposure. Hospitals, pharmaceutical suppliers, chemical companies and transportation providers all run the same category of equipment, refrigerated trucking included.

"We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk," Leatherman said. Chris Butera, CISA's acting executive assistant director for cybersecurity, said CISA is actively tracking the activity with government, industry and international partners, and added: "Every organization that depends on refrigeration and monitoring systems should assume it could be a target."

European authorities issued their own joint warning on Nov. 4, calling for immediate action to secure exposed equipment. The European Commission, the EU cybersecurity agency ENISA, Europol and national authorities are coordinating their response and sharing information about the incidents.

Nicole Parker, a former FBI special agent, has said the grocery store attacks are a form of asymmetrical psychological warfare that could reach the United States, arguing that hitting something as ordinary as the food aisle shakes the public's sense of security in a way other targets do not. She also cautioned against jumping to conclusions about who is responsible.