Malicious cyber actors are targeting the temperature and refrigeration controllers used in retail grocery and cold storage facilities, five federal agencies warned in a Nov. 5 advisory. Industry organizations FMI – The Food Industry Association and the National Grocers Association said in response that food retailers are working to protect their operations and collaborate with government partners.
The advisory urges owners and operators to act without delay to secure the systems. It was issued by the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services, the U.S. Department of Agriculture and the Department of Transportation. It describes the activity as global and does not cite specific incidents. The advisory came after an Oct. 12 cyberattack on French supermarkets and apparent cyberattacks Nov. 2 on grocers in five other European countries, as reported by The Associated Press.
How the attacks work
According to the advisory, actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to alter settings from a remote location and force units into continuous heating and defrost cycles, “which can cause widespread inventory loss and equipment hazards.” The agencies listed authentication bypass, arbitrary code injection and weak configurations as possible vectors.
A change in temperature could affect the service life of a system, create a fire hazard, cause loss of inventory or cause indirect harm to consumers if products are consumed after unsafe storage, the agencies said. Another possible effect is loss of visibility into current temperatures.
Recommended safeguards
The agencies urged owners and operators to take the following steps:
- Keep control system devices, controller panels in particular, off the public internet. Where remote access is necessary, protect it with a firewall or edge device updated to the latest version.
- Separate operational technology devices from business networks on a dedicated virtual local area network.
- Change default passwords, adopt strong password policies and use phishing-resistant multifactor authentication wherever feasible.
- Keep device firmware up to date and establish a process to identify, retire and replace legacy devices that are at end of life and no longer supported by the manufacturer.
- Limit access to the devices and IP addresses authorized to make changes.
- Maintain current backups offsite and offline, and test them.
- Enable logging and review logs for unexpected activity.
- Set reasonable setpoint limits for devices downstream of controllers and establish alerts for deviations.
The agencies recommend that U.S. organizations report suspicious or criminal activity to CISA’s 24/7 operations center and to the FBI’s Internet Crime Complaint Center or a local FBI field office.
Industry response
“FMI is aware of recent malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems and the November 5 advisory issued by the Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency, U.S. Department of Agriculture, Health and Human Services and Department of Transportation,” said Doug Baker, VP of industry relations. “The advisory specifically identifies electronic temperature and commercial refrigeration controllers used in retail grocery and cold-storage facilities and recommends immediate steps to strengthen their security.
“Food retailers, wholesalers and their partners routinely work to strengthen their cybersecurity practices as threats evolve. This includes maintaining strong authentication and access controls, keeping systems and software updated, securing remote access, monitoring systems for unusual activity, and working closely with technology providers and government partners. Cybersecurity is a shared responsibility, and the industry remains focused on strong cyber hygiene, preparedness and collaboration to help protect operations, products and consumers.”
NGA said it will continue to share the recommended safeguards and educate its members.
“Independent grocers take the safety of their stores, customers and food supply seriously, and protecting their operations against cybersecurity threats is an important part of that commitment,” an NGA spokesperson said. “We appreciate CISA, the FBI and their federal partners for raising awareness of threats to refrigeration and cold chain systems. Independent grocers have a longstanding commitment to working with government and law enforcement partners to protect their businesses and the communities they serve. NGA will continue to share the recommended safeguards and educate our members so retailers can take practical steps to protect their operations and maintain the trust their customers place in them.”
France blames Iran as attacks spread in Europe
AP put the toll of the Oct. 12 attack in France at about 700 of the country’s 10,000 supermarkets, where refrigerator temperatures climbed. The French government on Nov. 9 named Iran as the party behind the attack and said it would seek European sanctions against those responsible, AP reported, adding that Shahid Kaveh, a group described as a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps, was named by France’s national cybersecurity agency, ANSSI.
Reuters dated the summons of Iran’s ambassador to Nov. 10. Denials of malicious cyber operations are routine for Iran, the news agency reported.
On Nov. 2, apparent cyberattacks disrupted freezers and coolers at supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia, and some stores disposed of ruined food, AP reported.
Several dozen Delhaize stores, most in Belgium and a few in Luxembourg, had refrigeration affected by what the chain called an “IT incident,” according to AP. Carrefour counted 15 of its more than 700 Belgian stores as affected by a cyberattack targeting refrigeration, and Musgrave Group put the number of affected SuperValu stores in Ireland at 13, AP reported.
In Sweden, ICA Group said a limited number of its stores were affected, and Coop cited refrigeration and freezer problems at six stores, AP reported. One ICA Kvantum store in Sjöbo, Sweden, posted on Facebook that its fridges and freezers had been set to 50 degrees Celsius, or 122 degrees Fahrenheit, according to AP.
At least a half-dozen military commissaries lost the use of refrigerators in August, and Pentagon investigators are treating the malfunctions as a suspected cyberattack, Reuters reported.