Federal agencies urge cold chain operators to lock down refrigeration controllers

Five federal agencies have given grocery stores, cold storage operators and other cold chain businesses a clear set of steps for securing the controllers that keep their products cold. On November 5, CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation released a joint fact sheet on hardening industrial refrigeration and cold chain monitoring systems.

The agencies say malicious cyber actors are targeting vulnerabilities and weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. The guidance covers the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors.

What the agencies are seeing

According to the fact sheet, attackers may try to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards. The agencies list authentication bypass, arbitrary code injection and weak configurations as the routes in. They also warn of a denial-of-view condition, where operators lose visibility into current temperatures.

TechCrunch reports that the warning follows waves of attacks on refrigeration systems in Europe and the UK, and that the U.S. Department of Defense is investigating hacks on military-run freezers, citing Reuters. TechCrunch also reports that some affected systems were remote-controlled refrigeration units made by Danish company Danfoss that no longer receive security updates. The U.S. government has not attributed the activity to a particular group, according to TechCrunch.

The steps for operators

The fact sheet's mitigations align with the Cross-Sector Cybersecurity Performance Goals from CISA and NIST. The first is to keep control system devices, especially controller panels, off the public internet, and to protect any necessary remote access with a firewall or edge device updated to the latest version. The agencies also recommend a dedicated OT VLAN to separate refrigeration controls from business networks.

On credentials, the guidance calls for changing default passwords, enforcing strong password policies and using phishing-resistant multifactor authentication where feasible. Operators should keep firmware up to date and run a lifecycle process to identify, retire and replace end-of-life devices the manufacturer no longer supports.

The remaining steps are device and IP allowlisting limited to those authorized to make changes, current offsite and offline backups that are tested, logging with regular review for unexpected activity, and reasonable setpoint limits for downstream devices with alerts on deviations.

The fact sheet is tagged for small and medium businesses as well as state, local, tribal and territorial governments. The FBI urges organizations to report any suspicious activity.