Somebody figured out that the easiest way to hurt a supermarket is to turn its freezers into ovens. No ransomware note needed, no data theft. Just a thermostat and an open door on the internet.
According to TechCrunch, CISA, the FBI, and the Departments of Agriculture, Health and Human Services, and Transportation have issued a joint warning about an “ongoing cyber threat” to internet-connected refrigeration and cold chain monitoring systems. Targets include grocery stores, cold storage facilities, U.S. military bases, and at least one blood bank in France. The agencies say attackers could change temperatures and cause fire hazards, inventory loss, and shortened equipment life.
Two waves of attacks across the UK and Europe have already hit units in at least a dozen countries, spoiling food and destroying produce. Some affected systems were remote-controlled units from Danish manufacturer Danfoss, which had stopped issuing security updates for its customers’ freezers. That detail matters most. A vendor ends support, the hardware keeps running, and the remote management interface stays reachable by anyone who finds it.
In the French blood bank case, attackers pushed temperatures up in units holding donated blood but were stopped before the supply was compromised. That’s luck and fast response, not good design. The Pentagon is also investigating a string of freezer hacks on military systems, per Reuters.
Nobody official has named a culprit. Security researchers have broadly pointed to Iran, and U.S. officials reportedly suspect the same. Treat that with caution. Attribution is slow and often political, and the real lesson doesn’t depend on who it is. These devices are easy to reach and easy to abuse.
The government’s advice is basic, which tells you something about the state of things:
- Take remote control systems off the internet
- Change and strengthen passwords
- Apply patches where possible
- Retire equipment the vendor no longer supports
Notice what’s missing: any pressure on manufacturers. Operators are told to replace gear that was sold as a long-lived industrial asset, then abandoned. Cold storage runs on thin margins, so many will simply hope they aren’t next.
This fits a broader pattern. Water utilities, hospitals, and pipeline operators have all learned that operational technology was bolted onto the internet for convenience, with security as an afterthought. Refrigeration is just the latest, and an unusually physical one. Spoiled food is a cost. Spoiled vaccines or blood is a public health problem.
CISA’s acting cybersecurity chief Chris Butera said every organization that depends on these systems “should assume it could be a target.” He’s right. But assuming you’re a target doesn’t help if your vendor stopped patching years ago and replacement costs six figures. Expect more of these attacks, and expect regulators to be asked, again, why connected devices can be sold with no obligation to keep them safe.