Overnight on October 11, someone reached into the refrigeration controllers at hundreds of French supermarkets and turned the cold cases into ovens. Temperatures climbed as high as 122°F. Some units caught fire. Managers found out when they opened the doors in the morning, and the food went in the dumpster.
On November 9, Devin Morgan joined NewsRadio 1040 WHO in Des Moines to talk through the cold-chain cyberattacks and the federal warning that followed. His answer to the first question set the tone for the rest of the segment.
"Anything that we connect to the internet is not safe. It is vulnerable to hacking."
Listen to the full segment, about seven minutes.
What the FBI and CISA refrigeration warning says
On November 5, CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation issued a joint fact sheet on industrial refrigeration and cold-chain monitoring systems. The agencies say attackers target the electronic temperature controllers in grocery stores and cold storage facilities. Where a controller is unpatched or reachable from the internet, an attacker can change its settings and force the units into continuous heating and defrost cycles.
The fact sheet lists what that does: spoiled inventory, fire hazards, shorter equipment life, and harm to anyone who eats food stored at unsafe temperatures. It also warns that an attacker can hide the real temperatures from the operator. The fact sheet names no products, no victims and no attackers.
Three waves in three months
Devin described three waves on air. Here is where each one stands today.
Late August. Refrigeration failures spoiled food at no fewer than six commissaries on US military bases. Army investigators, the Defense Criminal Investigative Service and US Cyber Command are treating them as a suspected cyberattack. The Pentagon has not confirmed a hack, and nobody has shown a link to Europe.
October 11 and 12. About 700 French supermarkets, by press estimates. French authorities later disclosed that refrigeration at medical facilities, including blood service sites, took hits too. Nothing published so far shows that any blood spoiled.
November 1 and 2. More than 100 stores across Belgium, the Netherlands, Sweden, Ireland and other European countries.
Nobody has reported a ransom demand. In early November, two pro-Russian hacktivist groups claimed responsibility on Telegram and then deleted the posts. No one has verified that claim, and no government has attributed the attacks to anyone.
"You and I are the targets"
The host asked who the real target was. Devin did not name a supermarket.
"I think you and I are the targets. … It's meant to cause panic and disruption within the supply chain. The whole cold supply chain is potentially vulnerable."
A spoiled freezer case is a loss for one store. A string of them across a region, timed for the holiday season, is a message to everyone who buys groceries. That framing matters for operators in North Texas. The controller in your walk-in cooler does not care which country it sits in. It cares whether someone can reach it.
Security and convenience pull in opposite directions
Most of these controllers sit on the internet for a reason. Somebody wanted the convenience.
"Whenever we're talking about security and convenience, those two butt heads. They are polar opposites of each other."
A refrigeration vendor can watch temperatures and adjust set points from an office across town. That saves a service call. It also opens a door that nobody on site watches, and the federal fact sheet names authentication bypass and weak configurations among the ways in. A factory password that nobody changed counts as a weak configuration.
The fix France used is not fancy
Devin's words: "These are not whiz-bang ideas." The federal fix list reads the same way.
Take the controllers off the public internet. If a vendor needs remote access, put it behind a firewall or a secured edge device and keep that device updated.
Put refrigeration and other building equipment on their own network, separate from the office computers and the point-of-sale system.
Change every default password. Use multifactor authentication wherever the equipment supports it.
Update firmware, and replace controllers the manufacturer no longer supports.
Allow changes only from approved devices and addresses.
Turn on logging and read the logs. Set limits on how far a set point can move, and send an alert when it moves.
It works. Palo Alto Networks' Unit 42 counted 1,853 internet-exposed refrigeration controllers in France in the first half of October. By November 6 the count had fallen to 316. That is an 83% drop in about a month, after France's national cybersecurity agency told operators to pull these devices off the internet.
Your home has the same flaw
Devin did not stop at commercial refrigeration.
"That goes for everybody on everything, whether it's your phone, your doorbell camera, or the Wi-Fi router that your internet provider gave you. If you're not changing those default settings, you are particularly at risk."
This has happened before. In 2016, the Mirai botnet hijacked hundreds of thousands of home cameras and video recorders that still ran factory passwords, then used them to knock major websites offline.
Three checks for tonight. Log into your router and change the admin password. Turn on automatic updates for every camera, doorbell and smart device that offers them. Delete the apps and accounts for devices you no longer use.
Keep 72 hours on the shelf
Devin tied the attacks to a broader trend on air. The European Union urges residents to keep at least 72 hours of supplies at home and names cyberattacks among the risks. FEMA's Ready.gov recommends at least three days of non-perishable food and one gallon of water per person per day. If a cold-chain attack ever reaches your grocery store, the pantry decides how much it matters to you.
From the burglar to the hacker
The host asked what Devin tells the homes and businesses that call him in.
"We look at [a property] from every aspect, from the burglar to the hacker. … A lot of it is a much simpler fix than most people realize."
That work runs through PRO-tect Premier Investigations, an affiliated firm that performs threat and vulnerability assessments for homes and businesses. PRO-tect holds TX DPS Class C License #C28696201. Findings belong to the client and may be used with any provider.
Thirteen Alpha Solutions LLC, 4364 Western Center Blvd #2105, Fort Worth, TX 76137. TX DPS Class C License #C31017501.
