Attacks on supermarket and blood storage systems prompt US warning

Attackers don’t have to steal information to cause serious harm. Sometimes, changing a temperature setting is enough. On November 5, the US Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and three other federal agencies issued a warning urging operators to secure industrial refrigeration and cold-chain monitoring systems. The warning follows cyberattacks on supermarket refrigeration systems across Europe. Separately, France’s national blood service confirmed that the monitoring and control systems at three of its cold-storage sites had been affected. Staff intervened before any blood products or samples were compromised. The incident showed how a connected cooling system can put essential supplies at risk. On October 13, after the first attacks in France , refrigeration supplier Danfoss advised its Dutch customers to disconnect their systems from the public internet and reconnect only through a secure network. A Danfoss spokesperson told NOS that most stores followed the advice. When similar attacks reached the Netherlands on November 2, major supermarket chains were reportedly unaffected. At least 17 businesses, mainly butcher shops and small neighborhood stores, had their refrigeration systems compromised. Danfoss said that the affected systems were still accessible through unsecured connections and used default passwords. The spokesperson said the attacks could have been prevented if the recommended precautions had been taken. CISA and its partners warned that attackers may exploit authentication bypass flaws, code-injection vulnerabilities, or weak configurations in refrigeration controllers. Successful attacks could let them change temperatures or force equipment into continuous heating or defrost cycles. The agencies recommend reducing that risk by keeping control panels off the public internet, isolating operational equipment from business networks, changing default passwords, using strong authentication, patching firmware , and replacing unsupported devices. They also recommend setting safe operating limits and alerts for temperature changes outside those limits. What about home appliances? You don’t need an industrial refrigeration unit to adopt some of these precautions. Check whether you need remote access. If you never use a device while away from home, disable that feature. Check the manufacturer’s instructions first; disabling remote access may also affect alerts or smart-home integrations. Check who can access the appliance, including suppliers, and how that access is protected. Change default passwords and secure the associated account. Use a strong password and enable two-step verification wherever the appliance or app supports it. Protecting the app account matters as well as protecting the appliance itself. Keep firmware and apps updated. Turn on automatic updates where available, and don’t ignore manual update prompts. “One of the best cybersecurity suites on the planet.” According to CNET. Read their review → About the author Was a Microsoft MVP in consumer security for 12 years running. Can speak four languages. Smells of rich mahogany and leather-bound books.