Five Federal Agencies Warn Grocers of Refrigeration Cyberattacks

By James Calloway

Cyber actors forced refrigerator temperatures to 122 degrees Fahrenheit at a Swedish supermarket, and five U.S. federal agencies now warn that American grocers face the same threat. The Nov. 5 advisory from CISA, the FBI, the Department of Health and Human Services, the USDA and the Department of Transportation urges owners and operators of retail grocery and cold storage facilities to secure their refrigeration controllers without delay.

The agencies describe the activity as global and cite no specific U.S. incidents. But the warning follows a Oct. 12 cyberattack on French supermarkets and apparent attacks on Nov. 2 against grocers in five other European countries, The Associated Press reported.

How do the attacks work?

Attackers exploit unpatched, internet-accessible temperature and refrigeration controllers to alter settings remotely, the advisory said. They force units into continuous heating and defrost cycles, "which can cause widespread inventory loss and equipment hazards."

The agencies listed three possible vectors: authentication bypass, arbitrary code injection and weak configurations. A temperature change can shorten system service life, create a fire hazard, destroy inventory or harm consumers who eat products stored unsafely. Attackers can also cut off operators' visibility into current temperatures.

What safeguards do the agencies recommend?

The advisory lays out eight concrete steps:

• Keep control system devices, especially controller panels, off the public internet; protect necessary remote access behind an updated firewall or edge device.
• Separate operational technology from business networks on a dedicated virtual local area network.
• Change default passwords, adopt strong password policies and use phishing-resistant multifactor authentication where feasible.
• Update device firmware and establish a process to retire and replace end-of-life devices no longer supported by manufacturers.
• Limit access to authorized devices and IP addresses only.
• Maintain current offsite, offline backups and test them.
• Enable logging and review logs for unexpected activity.
• Set reasonable setpoint limits downstream of controllers and establish alerts for deviations.

The agencies recommend reporting suspicious or criminal activity to CISA's 24/7 operations center and to the FBI's Internet Crime Complaint Center or a local FBI field office.

What happened in Europe?

The Oct. 12 attack struck about 700 of France's 10,000 supermarkets, with refrigerator temperatures climbing, AP reported. France on Nov. 9 blamed Iran and said it would seek European sanctions against those responsible. ANSSI, France's national cybersecurity agency, named Shahid Kaveh, a group described as a cyber unit affiliated with Iran's Islamic Revolutionary Guard Corps, as responsible. Reuters dated the summons of Iran's ambassador to Nov. 10. Iran routinely denies malicious cyber operations, the news agency reported.

On Nov. 2, apparent attacks disrupted freezers and coolers at supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia. Some stores disposed of ruined food, AP reported.

The chain-level toll: several dozen Delhaize stores, most in Belgium and a few in Luxembourg, lost refrigeration to what the chain called an "IT incident." Carrefour counted 15 of its more than 700 Belgian stores affected. Musgrave Group put affected SuperValu stores in Ireland at 13.

In Sweden, ICA Group said a limited number of stores were hit, and Coop cited refrigeration and freezer problems at six stores. One ICA Kvantum store in Sjöbo posted on Facebook that its fridges and freezers had been set to 50 degrees Celsius.

At least a half-dozen military commissaries lost refrigeration in August, and Pentagon investigators are treating the malfunctions as a suspected cyberattack, Reuters reported.

How is the industry responding?

"FMI is aware of recent malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems and the November 5 advisory," said Doug Baker, VP of industry relations at FMI – The Food Industry Association. "Food retailers, wholesalers and their partners routinely work to strengthen their cybersecurity practices as threats evolve. Cybersecurity is a shared responsibility, and the industry remains focused on strong cyber hygiene, preparedness and collaboration to help protect operations, products and consumers."

The National Grocers Association said it will keep sharing the recommended safeguards with members.

"Independent grocers take the safety of their stores, customers and food supply seriously, and protecting their operations against cybersecurity threats is an important part of that commitment," an NGA spokesperson said. "NGA will continue to share the recommended safeguards and educate our members so retailers can take practical steps to protect their operations and maintain the trust their customers place in them."

For grocers, the advisory turns refrigeration from a facilities issue into a security perimeter. Retailers that leave controllers internet-accessible now carry a documented, government-flagged risk to inventory, equipment and customers.