The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint warning regarding intense cyber activity targeting industrial cooling systems and cold-chain monitoring systems around the world. The warning, which included participation from the US Departments of Health, Agriculture, and Transportation, confirmed that attackers are seeking access to temperature control units used in vital sectors such as healthcare, food production, chemical facilities, and transportation.
Attack Mechanism and Resulting Risks
According to the joint statement, attackers exploit vulnerabilities in electronic control units that lack security updates or those directly connected to the internet. These devices allow operators to remotely monitor temperatures, manage defrost cycles, and control cooling equipment.
Hackers use techniques including authentication bypass, arbitrary code injection, or exploiting weak settings to forcibly modify temperatures. Among the most prominent risks resulting from these attacks are:
- Spoilage of food stock and sensitive medical products.
- Reduced lifespan of cooling equipment due to irregular operation.
- Creation of fire risks due to pressure on systems.
- Loss of visibility and the ability to monitor real temperatures, preventing operators from detecting faults.
What Does This Threat Actually Change?
This threat represents a dangerous shift from attacks targeting digital data to attacks targeting Operational Technology (OT), where software vulnerabilities lead to tangible physical consequences on the ground. It is no longer just about information theft, but has become a direct threat to food security and public safety.
Europe has already witnessed the repercussions of these attacks; between 250 to 350 supermarkets in France were subjected to attacks last October that led to the activation of defrost functions and increased temperatures. Additionally, the French Blood Establishment (EFS) reported an incident that affected cooling settings in three facilities for storing blood products.
Recommended Protection Steps
To counter these threats, the US agencies issued a set of technical recommendations to organizations:
- System Isolation: Separating Operational Technology (OT) systems from general business networks.
- Securing Access: Removing control units from the public internet and securing any necessary remote access.
- Identity Management: Changing default passwords and implementing strong authentication policies.
- Continuous Updating: Applying all available security updates to patch vulnerabilities.
- Physical Oversight: Enforcing safe temperature limits to prevent controllers from operating outside acceptable ranges.