Attackers are reaching into commercial refrigeration controls and changing setpoints, forcing units into continuous heating and defrost cycles. The result is spoiled stock, shortened equipment life and, in the worst case, a fire hazard.
What happened
CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation issued a joint advisory on electronic temperature controllers and refrigeration management systems used in retail grocery and cold storage. The agencies say attackers use authentication bypasses, arbitrary code injection and weak configurations to change settings remotely and to reduce the operator's visibility of current temperatures.
The warning follows a run of incidents in Europe. An estimated 250 to 350 French supermarkets were affected in October when defrost functions were activated remotely. A second wave in November hit more than 115 stores across six countries, with some systems shutting down and others pushed to 50 degrees Celsius. On 3 November the French Blood Establishment confirmed that an incident at a refrigeration equipment provider altered temperature and defrost settings at three sites used to store blood products.
Who is affected
The advisory is aimed at any site that depends on refrigeration or cold-chain monitoring:
- Retail grocery, food service, distribution and cold storage sites with controllers or monitoring gateways reachable from the internet
- Units still running default passwords or a single shared vendor account
- Sites where the refrigeration network sits flat on the office LAN with no separation
What to do now
Get every controller and monitoring gateway off the public internet this week and put remote access behind a VPN.
- Inventory every controller, gateway and remote-monitoring box that answers on a public address or a forwarded port
- Replace default and shared credentials, and remove accounts for contractors who have left
- Segment refrigeration and building controls from the business network, with outbound access only where it is needed
- Set hard safe limits and alerting so a unit cannot be driven outside its operating range without someone noticing
- Patch or replace end-of-life controllers that no longer receive vendor firmware
What this means for South African businesses
South African food retail and cold chain sites typically inherit a controller installed by a refrigeration contractor years ago, sitting behind a cellular router with a port forward nobody has reviewed since commissioning. That is precisely the exposure pattern this advisory describes, and the attackers need no zero-day, only reachability and a default login. For an industrial or retail client base, this is a stronger reason to audit operational technology exposure than most of the vulnerability noise in a given week.
Source: BleepingComputer.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.