Fridge cyberattacks hit 100+ more stores; FBI and CISA warn US

The supermarket fridge cyberattacks are back, and this time the US government is in the conversation. Overnight on November 1–2, attackers pushed refrigeration controllers at more than 100 European stores into heat and defrost cycles. Three days later, the FBI, CISA and three other US agencies published a joint advisory for anyone who runs refrigeration controllers. If you own a grocery, a restaurant, a convenience store or a cold-storage room with remote temperature monitoring, this is your problem now. It isn't only a European headline.

What actually happened

• Wave one. In October, attackers set refrigeration controllers at hundreds of French supermarkets to defrost. We wrote about it at the time. Reports don't agree on the exact store count.
• Wave two. BleepingComputer counts more than 115 stores across six European countries. Unit 42 puts the count of countries higher. Some units shut down and others reached 50°C (122°F). France's blood service also confirmed altered settings at three blood-storage sites.
• The US advisory. On November 5, CISA, the FBI, HHS, USDA and DOT warned that attackers target unpatched or internet-reachable temperature controllers. The named methods are authentication bypass, code injection and weak configurations. Attackers can also hide the real temperatures, so staff don't see the problem.
• The exposure. Unit 42 found more than 5,000 internet-exposed devices from the manufacturers named in France's advisory on November 5–6. Exposed doesn't always mean vulnerable. Exposed devices in France fell from 1,853 to 316 after the first wave, so owners can fix this fast when they try.
• Who did it. Two pro-Russian hacktivist groups claimed the attacks on Telegram. Unit 42 says the claims aren't verified, and the way in is still unconfirmed. Default passwords are the main suspect.

Why it matters for your business

A walk-in cooler is your inventory. If a stranger can set it to defrost overnight, you lose a full night's stock, and your own dashboard can tell you everything is fine.

Most small operators didn't set up their controller's remote access. The refrigeration contractor did, often years ago, and nobody checked it after that. Here's what to do:

1. Call your refrigeration contractor this week. Ask whether any controller or monitoring gateway can be reached from the internet, and who has the login.
2. Get it off the public internet. If you need remote access, use a VPN or a gateway with real authentication. A port forward isn't enough.
3. Change every default password and turn on MFA wherever the system supports it.
4. Add a second alarm that the controller can't silence. A cheap standalone wireless temperature sensor that texts you is a separate system. The attacker would have to compromise it too.

Sources: Unit 42, BleepingComputer.