U.S. urges critical infrastructure orgs to secure refrigeration systems ASAP after EU supermarket and blood bank attacks

Following recent cyber attacks on French blood banks and European supermarkets, U.S. federal agencies are urging critical infrastructure organizations to immediately secure industrial refrigeration systems against remote tampering and temperature manipulation.

Key takeaways

1. Cybercriminals are actively targeting unpatched flaws, misconfigurations, and weak or hard-coded passwords in commercial cold-chain and refrigeration controllers globally.
2. Attackers are gaining remote access to manipulate temperature controls and spoil essential products, such as blood and food.
3. CISA, the FBI, and other U.S. agencies are advising organizations to isolate OT systems, secure or remove remote access, patch critical vulnerabilities, and replace end-of-life devices.

Critical infrastructure organizations in the healthcare, chemicals, transportation, and food and agriculture sectors must urgently harden their industrial refrigeration and cold-chain monitoring systems to protect food, medicines, and other essential products against ongoing cyber attacks.

That’s the call from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and other U.S. government agencies, following a series of alarming breaches against refrigeration systems in French blood banks and European supermarkets.

“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” CISA Acting Executive Assistant Director for Cybersecurity Chris Butera said in a statement.

Attackers are remotely targeting electronic-temperature and commercial-refrigeration controllers used in grocery stores and cold storage facilities. They’re looking for unpatched vulnerabilities and other security flaws, such as misconfigurations, according to the agencies.

Once attackers gain remote access to these systems, they try to tamper with these machines’ temperature controls to damage their refrigerated products. The temperature changes could also trigger fire hazards.

In a joint fact sheet, the agencies recommend organizations immediately take the following steps:

• Use strong authentication mechanisms and change systems’ default passwords.
• Keep systems updated and promptly patch critical vulnerabilities.
• Replace legacy devices that have reached end-of-life status.
• Identify systems accessible from the internet.
• Isolate operational technology (OT) systems from business networks.
• Remove unnecessary remote access.
• Secure necessary remote access.
• Maintain offsite backups.

“This fact sheet provides clear, practical steps that network defenders can take to reduce that risk and protect operations,” said Brett Leatherman, cyber branch operations director at the U.S. Federal Bureau of Investigation (FBI), one of the authoring agencies.

The U.S. Department of Health and Human Services (HHS), U.S. Department of Agriculture (USDA), and the U.S. Department of Transportation (DoT) also contributed to the joint fact sheet.

Attackers hit hundreds of grocery stores in France several weeks ago that caused food to spoil and triggered fires. The National Cybersecurity Agency of France (ANSSI) recently told Cybersecurity Dive it has been investigating the attacks since they started in mid-October and is aware of compromises involving Danfoss AK-SM and AK-SC series controllers, as well as Copeland and Dixell XWEB controllers.

How Tenable can help defend against recent cold-chain cyber attacks

Recent attacks on cold-chain infrastructure and other types of critical supply-chain infrastructure highlight the importance of asset visibility for security teams. As operational environments become increasingly connected, the line between IT and OT continues to blur, often leaving critical cyber-physical systems inadvertently exposed to the internet.

The Tenable One Exposure Management Platform provides comprehensive visibility and actionable intelligence to heed CISA’s warnings and secure converged IT/OT environments. By unifying cyber exposure signals and threat intelligence across your attack surface, Tenable One helps security teams to seamlessly find, prioritize, and secure vulnerable systems before attackers manipulate them.

Here are some of the ways Tenable supports security teams across industries in mitigating threats, including AI-assisted attacks, to critical OT systems and supply chain infrastructure:

• Identify web-exposed assets with attack surface management (ASM): Attackers are actively scanning the web for internet-accessible refrigeration controllers. Tenable One’s external attack surface management (EASM) capabilities allow you to view your infrastructure from an attacker's perspective. By continuously discovering external-facing assets and rogue internet connections, your teams can immediately identify systems accessible from the internet — one of CISA's key directives — and lock down unnecessary remote access points.
• Achieve ground-truth OT/CPS visibility: To address critical vulnerabilities and identify end-of-life equipment, you need a complete and accurate asset inventory. Tenable’s purpose-built OT security capabilities deliver a comprehensive inventory of all OT, IoT, and IT assets. By querying deep device details, including the specific firmware version of controllers like the targeted Danfoss and Copeland models, as well as associated known vulnerabilities and misconfigurations, Tenable helps eliminate operational blind spots.
• Visualize attack paths and prevent lateral movement: Threat actors frequently exploit web-exposed IT infrastructure to pivot laterally into critical OT environments. Tenable One maps critical risks and continuously visualizes viable attack paths, showing exactly how attackers could move through your converged IT and OT environment. These insights enable security teams to effectively enforce network segmentation, block malicious communications, and securely isolate OT systems from business networks.
• Prioritize real-world risk and human safety: With a surge of alerts and limited patching windows, security teams need to know what to fix first. Tenable One correlates vulnerability data with threat intelligence, exploitability, deployed compensating controls, and asset context. This context helps your teams focus remediation on critical exposure findings such as default passwords, remote code execution (RCE), or changes in a device’s running state that pose significant and verifiable risk to production uptime and physical safety.

By taking command of your entire attack surface with a unified exposure management strategy, your organization can proactively defend your most critical industrial systems from the evolving global threat of cyber sabotage. 

Learn more

• US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems (U.S. government fact sheet)
• CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity (U.S. government statement)
• French authorities probe cyberattack targeting nation’s blood supply (Cybersecurity Dive)
• French blood banks hit alongside cyberattack on European supermarkets (Reuters)