CISA and FBI warn of attacks on industrial refrigeration systems
Original title: CISA, FBI Urge Action to Protect Industrial Refrigeration Networks
European incidents drove cold rooms as high as 110°C, and no threat actor has been named.
CISA, the FBI and other US agencies said on November 5 they are aware of malicious activity against industrial refrigeration and cold-chain monitoring systems worldwide. Reported cases include Danfoss-administered supermarket systems in France and other European countries on October 11, a similar event on November 1 across at least nine countries, and a Coolworld attack that heated France’s National Blood Service storage to 110°C. Agencies say actors may use exposed or unpatched controllers, authentication bypass, code injection or weak configurations to force heating and defrost cycles.
Unconfirmed: The incidents have not been attributed to a named threat actor.
- October 11 supermarket systems were reportedly set as high as 50°C (122°F).
- Censys reported a 53% drop in exposed Danfoss StoreView and Copeland/Dixell XWEB controllers.
- Priority sectors named include healthcare, chemical, food and agriculture, and transportation.
- Agencies also urge isolating OT from business networks and keeping offline backups.
Impact: Remote temperature changes that can destroy inventory and equipment
| Product | Affected |
|---|---|
| Danfoss StoreView | — |
| Copeland/Dixell XWEB | — |
- 1.Keep refrigeration controller panels off the public internet.
- 2.Place required remote access behind a firewall and update to the latest version.
- 3.Change default passwords and require phishing-resistant multi-factor authentication.
- Victims
- EFS
- Countries
- United StatesFrance
From the original article
2 min read at infosecurity-magazine.com
The CISA advisory follows a swathe of attacks in which hackers have tampered with the temperatures of internet-exposed supermarket refrigeration systems
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.