US tells supermarkets to lock down refrigeration systems after European hacks

US agencies are urging owners and operators of commercial refrigeration systems to act fast, laying out steps they say should be taken immediately. The advice: keep control system devices off the public internet, keep firmware updated, and report anything that looks like unexpected activity. The warning comes in a joint statement that also carries the names of the USDA, Health and Human Services and the Department of Transportation — the agencies whose sectors lean hardest on industrial refrigeration and cold chain monitoring.

According to the statement, hackers can exploit specific refrigeration system flaws and then move temperatures around. The consequences it lists are concrete: fire hazards, lost inventory, and indirect harm to consumers who eat food that sat at unsafe temperatures. Operators also risk losing visibility into what their temperatures currently are.

Europe already has the scars. In early October, hackers got into programmable controllers that regulate commercial refrigeration and messed with systems at hundreds of grocery stores across France, per sister publication Cybersecurity Dive. They pushed temperatures up to 120 degrees Fahrenheit, which led to fires, spoiled food and millions of dollars in damage.

A second wave hit just weeks later. Hackers reached dozens of internet-exposed refrigeration devices at major grocery chains in multiple European countries and reset the controls to defrost, Cybersecurity Dive reported.

The French Blood Establishment, which oversees the country's blood supply, was also hit. An unknown hacker manipulated temperature controls in cold storage rooms at three of its sites, according to Cybersecurity Dive.