US and European authorities have issued back-to-back warnings that attackers are tampering with commercial refrigeration controllers, a campaign that began in European grocery stores and has now reached sites run by France’s national blood service. The advisories arrived within 24 hours of each other and signal that officials see the activity as a continuing, cross-sector threat rather than a retail problem.
FBI, CISA and Three US Departments Publish a Joint Cold-Chain Advisory
The FBI and the Cybersecurity and Infrastructure Security Agency, together with the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation, published a joint advisory on Thursday stating that attackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide. The agencies said the intruders go after electronic temperature controllers and commercial refrigeration management systems that are unpatched or exposed to the internet.
The advisory describes authentication bypass, arbitrary code injection and weak configurations as the methods used to take control. Once inside, attackers force units into continuous heating and defrost cycles, which raises internal temperatures and spoils stored goods.
Chris Butera and Brett Leatherman Describe a Global Target Set
Chris Butera, CISA’s acting executive assistant director for cybersecurity, said that every organization that depends on refrigeration and monitoring systems should assume it could be a target. Brett Leatherman, who directs operations for the FBI’s Cyber Branch, said the systems are being targeted across critical infrastructure sectors around the world.
The advisory’s list of mitigations covers strong authentication, patching, identifying internet-accessible systems, removing unnecessary remote access, disconnecting equipment from the internet where possible and changing default passwords.
Reported Absence of Documented US Supermarket Attacks
The Register reported that it knows of no documented attacks on US supermarkets and that the FBI had not answered its question on the point. The reach of the US advisory into healthcare, food, chemical and transport operators therefore rests on the agencies’ warning about the technique, not on confirmed American victims in the retail sector.
ENISA and Europol Issue Their Own Statement After a New Wave
A day earlier, on Nov. 4, the European Union Agency for Cybersecurity (ENISA), the European Commission’s DG CNECT, Europol’s European Cybercrime Centre, the EU CSIRTs Network and EU-CyCLONe issued a joint statement urging immediate action. The statement followed a fresh wave of incidents on Nov. 1 and 2.
According to The Register, unknown actors have been hacking thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg and Sweden since mid-October. Temperatures in some units were pushed as high as 50 degrees Celsius (122 degrees Fahrenheit), spoiling food and creating a fire risk.
Supermarket Chains Named in French Reporting
Reports cited by Security Affairs say about 300 Intermarche and Netto stores were affected in France, along with fewer than 100 Cooperative U outlets. No attribution for the campaign has been reported in any of the sources reviewed.
Etablissement Francais du Sang Sites Hit Overnight
The widening of the campaign into healthcare came from France’s national blood service, the Etablissement francais du sang (EFS). Hackread and The Record reported that refrigeration thresholds at three EFS sites were altered overnight on Nov. 1 and 2, through equipment managed by a refrigeration supplier.
EFS said its monitoring alarms triggered and staff secured plasma. The service reported that no blood products were lost and that no health consequences have been identified. French press reportedly said a setting normally near minus 30 degrees Celsius had been changed to 110 degrees Celsius, but EFS itself did not publish that figure.
Unclear Link Between Blood-Bank and Supermarket Incidents
The Record noted that it is unclear whether the blood-bank incidents are connected to the supermarket attacks. The same outlet also reported that freezers at several US military commissaries unexpectedly switched into defrost or heating modes in August, and that any connection to the current campaign is unclear.
What the Warnings Mean for Healthcare and Food Operators
The blood-service incident is the first in the reported campaign to touch healthcare supplies, since plasma stores sit in the same class of temperature-controlled equipment as grocery freezers. The advisories extend concern to US healthcare, food, chemical and transport operators that rely on similar controllers.
The economic damage has not been quantified, though the volume of affected stores and the spoilage involved point to potentially millions of euros in lost stock.
With thousands of controllers reportedly compromised in Europe and US agencies now publicly treating the technique as a global threat, the next signals to watch are whether any attribution emerges and whether American operators report confirmed incidents.
