Five United States federal agencies issued a joint advisory on Thursday warning operators about attacks on industrial refrigeration and cold-chain monitoring systems. The FBI, the Cybersecurity and Infrastructure Security Agency, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation all put their names to it.
The advisory follows a run of incidents in Europe. Since the middle of October, unknown attackers have compromised thousands of remote-controlled refrigeration systems at hundreds of grocery stores in France, Belgium, Ireland, Luxembourg and Sweden, raising temperatures to 50 degrees Celsius, spoiling stock and in some cases starting fires. Delhaize supermarkets in Europe were among those affected.
The agencies say attackers "may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers", bypassing authentication, injecting arbitrary code, abusing weak configurations and forcing units into continuous heating and defrost cycles.
"We are seeing these systems targeted across critical infrastructure sectors globally," Brett Leatherman, operations director of the FBI's cyber branch, said in a statement.
The risk is not confined to food. Cold-chain monitoring also covers temperature-controlled medications.
On the American side the picture is thinner. Reuters reported on 29 October, citing four officials, that the Pentagon is treating freezer malfunctions at US bases in August, which spoiled food, as a suspected cyberattack. The Register, which reported the advisory, said it had found no documented digital attacks against refrigeration systems in American supermarkets, and that the FBI had not responded to its question by the time of publication. Separately, Ahold Delhaize, owner of Food Lion, Giant Food and Stop & Shop, took IT systems offline in October after a cyberattack; nothing connects that incident to refrigeration.
The recommended mitigations are the standard set: keep industrial control systems off the public internet, protect any remote access with an up-to-date firewall or edge device, put operational technology on a dedicated VLAN, replace default passwords and use phishing-resistant multi-factor authentication, patch promptly, retire unsupported legacy devices, maintain device and address allow-lists, keep tested offline backups and review logs.
The arithmetic of the advisory is worth laying out, because it is the most comfortable position a federal document can occupy. Thousands of units in Europe. Hundreds of stores. Five countries. In the United States, against supermarket refrigeration, nothing at all.
That last figure is the valuable one, because it cannot be contradicted by anything that has already happened.
Consider how the document is now able to perform. If American supermarket freezers are attacked, the advisory identified the threat in advance. If they are not, the advisory prevented it. There is no third reading available, and no measurement that would separate the two.
Our analysts note the unusual efficiency of the arrangement. Most security controls have to be bought, installed, configured and maintained for a year or more before anyone can credit them with an outcome. This one was credited on Thursday afternoon, at the moment of publication, and at no cost to the grocery sector whatsoever.
The mitigations themselves are, in fairness, the ordinary ones, and would be worth doing if nothing at all were happening anywhere in the world. That is precisely the difficulty in assessing them. A supermarket that follows every line of the advisory and a supermarket that never reads it will, on the current American record, report identical results.
The Department of Unnecessary Research has reviewed the United States figures and finds them conclusive. No supermarket freezer in America has been digitally attacked since the advisory was published. The advisory was published on Thursday.