What happened
CISA, the FBI and other federal agencies published a joint advisory on November 5 warning that US authorities are "aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally." It follows several incidents in which attackers reached internet connected cooling equipment and changed settings.
The pattern began in Europe. On October 11, supermarket chains in France and elsewhere destroyed food stock after attackers compromised systems administered by refrigeration provider Danfoss, reportedly pushing units to 50 degrees Celsius. On November 1, supermarkets in at least nine European countries were reported impacted. Most recently, an attack on equipment provider Coolworld drove cold storage rooms at France's national blood service, EFS, to 110 degrees Celsius.
The advisory concentrates on mechanics rather than motive. Attackers, it says, may exploit weaknesses in unpatched or internet accessible controllers "to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards." Authentication bypass, arbitrary code injection and weak configurations are named as the ways in. No threat actor has been publicly attributed.
The agencies listed specific actions: keep controller panels off the internet, place a firewall or edge device in front of any remote access, isolate operational technology from business networks, change default passwords, enforce phishing resistant authentication, retire end of life devices, limit changes to authorised addresses, and keep tested backups offline. Chris Butera, CISA's acting executive assistant director for cybersecurity, said any organisation depending on these systems "should assume it could be a target."
Censys reported on November 5 that internet exposure of the affected Danfoss StoreView and Copeland/Dixell XWEB controllers had fallen 53%.
Why this is a GRC story
A thermostat is a regulated control now. Food safety, medical storage and chemical handling rest on temperature ranges a person wrote down and an auditor accepted. When that range can be edited from the internet, the control that satisfied the audit is the object an attacker turns up.
The risk register asked the wrong question. Most organisations file industrial control equipment under facilities, outside the security programme. Yet the list is not exotic: default passwords, flat networks, no inventory of end of life kit. A routine assessment finds these when someone is allowed to look at the plant.
Third party exposure arrives without a contract change. The European cases ran through refrigeration providers and monitoring platforms. A vendor that can change your controllers is a supplier risk, and the questionnaire should ask what that access can alter.
Someone has to own the off switch. A 53% drop in exposure within days means many devices could be disconnected quickly once the news got bad. Who may take a live cold room offline, and at what cost in spoiled stock, is a continuity decision that belongs in the plan.
What to watch
Watch whether European regulators turn these incidents into enforcement. The blood service case involves a public health provider, and France has shown limited patience with cyber failures in health settings.
The useful step this week is an inventory. Ask which cooling and monitoring systems are reachable from the internet, who holds credentials, and whether the provider can change settings for you. Most estates will find at least one device behind a default password.
Attribution: Analysis based on Infosecurity Magazine and related public reporting. This article is original commentary, not a repost of the source material.