Hackers are defrosting supermarket freezers. Is yours online?

If your fridges, freezers or cool room can be adjusted from a phone or a web page, someone else may be able to adjust them too. Reports from Europe say hackers have been turning up the temperature on supermarket freezers and spoiling the food inside.

On 5 November, five US government agencies published a joint fact sheet on refrigeration and cold chain monitoring systems. Their announcement warns of “ongoing cyber threat activity” targeting these systems worldwide. The agencies include the cyber agency CISA and the FBI.

Australia’s cyber agency got in first. The Australian Cyber Security Centre (ACSC) issued a high alert on 14 October about incidents affecting commercial refrigeration overseas. It says it hasn’t seen active targeting in Australia, but wants any business running internet-connected refrigeration to check its exposure. A high alert means acting quickly, within 48 hours.

The freezer gets told to defrost

The targets are the controllers that run commercial refrigeration: the boxes that set temperatures, log readings, manage defrost cycles and let a technician check in remotely.

The US agencies say attackers are going after controllers in grocery stores and cold storage sites that are unpatched or reachable from the internet. They may get in by bypassing logins, injecting their own code or exploiting weak settings.

Once in, they can change the temperature. They can also force units into continuous heating and defrost cycles. The agencies list the results:

• stock lost to spoilage
• a fire hazard
• a shorter life for the equipment
• possible harm to customers if products are consumed after being stored unsafely.

Attackers can also cut off the temperature display, so staff can’t see what’s happening.

The fact sheet names healthcare, chemical, food and agriculture, and transport as heavy users of these systems, including refrigerated transport.

“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s Acting Executive Assistant Director for Cybersecurity.

Spoiled stock across Europe

TechCrunch reports two waves of attacks in recent weeks that raised temperatures in supermarket fridges and freezers across at least a dozen countries. Produce and defrosted food were destroyed. A French blood bank’s cold storage was also targeted, but the attack was stopped before blood supplies were compromised.

Security researchers linked at least some of the attacks to internet-connected Danfoss refrigeration units, according to the same reports, which say Danfoss had stopped providing security updates for those units. Danfoss is one of the world’s biggest refrigeration makers.

Separately, security firm Claroty published flaws it found in Danfoss’s AK-SM 800A system manager, a central console used in supermarkets and cold stores. It said it found thousands of these management screens open to the public internet. Danfoss’s security advisory says the AK-SM 8xxA series is fixed in version 4.3.1. It isn’t known whether these flaws were used in the attacks, and the US warning doesn’t name a brand.

Why a small shop can be exposed

These systems are often set up for convenience. A technician who can log in from anywhere saves a call-out.

The risk comes when that login page sits on the open internet with a default password or old firmware. Attackers can scan for exposed controllers instead of breaking into your office network first, Claroty says.

The ACSC’s advice is short. Don’t expose controllers directly to the internet, especially older ones and those with remote access. Patch vulnerabilities promptly. Use strong authentication, access controls and a separate network. Watch for unusual automated activity and review logs.

The US fact sheet adds detail. If remote access is needed, put it behind a firewall or an up-to-date edge device. Change default passwords and use multi-factor authentication where possible. Retire devices the maker no longer supports. And set safe upper and lower temperature limits, with an alert when readings drift.

The ASD has broader advice for small businesses in its Essentials guidance.

Where to report

If you spot suspicious activity on your refrigeration systems, the ACSC says you can call 1300 CYBER1 (1300 292 371) or report it at cyber.gov.au.

Checklist

• Ask your refrigeration technician how they connect. Find out whether your fridge, freezer or cool room controller can be reached from the internet, and through which app, web page or remote-access tool.
• Take controllers off the open internet. If remote access is needed, have your IT provider put it behind a firewall or other edge device that’s kept up to date.
• Change default passwords on every controller and monitoring app. Use strong, unique passwords, and turn on multi-factor authentication where it’s offered.
• Ask for firmware updates. Have your technician confirm each controller is on the maker’s latest version. Danfoss AK-SM 8xxA system managers need version 4.3.1 or later.
• Replace unsupported equipment. Ask which controllers no longer get security updates from the maker, and budget to replace them.
• Keep controllers on their own network. Ask your IT provider to separate refrigeration systems from office computers and guest Wi-Fi.
• Set temperature alarms. Agree safe upper and lower limits for each unit, and make sure an alert reaches a named person when a reading drifts.
• Report anything odd to the ACSC. Call 1300 CYBER1 (1300 292 371) if temperatures or settings change without explanation.