WASHINGTON – The FBI is warning American grocery stores that hackers are going after their refrigerators and freezers.
The alert comes after cyberattacks on supermarket refrigeration systems across Europe spoiled food, sparked fires and left some freezers heating up to 122 degrees Fahrenheit. On Monday, France publicly blamed Iran for the largest of the attacks.
The FBI’s Warning
In a Nov. 5 advisory, the FBI and several other federal agencies said hackers are targeting the temperature and refrigeration controllers used in grocery stores and cold storage facilities.
According to the advisory, attackers can change settings from a remote location and force units into nonstop heating and defrost cycles. The agencies warned that could destroy inventory, damage equipment, create a fire hazard, or harm consumers if food is eaten after being stored at unsafe temperatures.
“Attackers are getting in through controllers that are unpatched, reachable from the internet or still using the default passwords listed in the manufacturer’s manual,” said Brett Leatherman, head of FBI cyber investigations.
The agencies urged stores to keep these systems off the public internet, change default passwords and keep software up to date.
No U.S. grocery store has been confirmed as a victim. The advisory describes the threat as global and does not cite specific incidents.
What Happened in Europe
In October, hackers remotely took control of refrigeration systems at about 700 of France’s 10,000 supermarkets. Investigators say the attackers raised temperatures inside the units as high as 122 degrees overnight. The attack caused major food spoilage and more than a dozen fires.
The supermarket chain Intermarché reported losses of “tens of millions of euros” in a single day.
Then on Nov. 2, apparent cyberattacks disrupted freezers and coolers at supermarkets in several other European countries, including Sweden, Belgium, Ireland, Luxembourg and Estonia. Some stores had to throw out ruined food. One store in Sweden posted on Facebook that its fridges and freezers had been set to 122 degrees.
France also reported a separate attack on several blood banks that tried to push temperatures to extreme levels. It was stopped before any blood products or samples were damaged.
France Blames Iran
On Monday, French officials accused Iran’s Islamic Revolutionary Guard Corps of carrying out the October attack. France’s national cybersecurity agency linked it to a cyber unit called Shahid Kaveh, and investigators say the hackers used Farsi and Iran-linked IP addresses.
“This is an attack of unprecedented scale and aggressiveness,” French Foreign Minister Jean-Noël Barrot said.
France summoned Iran’s ambassador and said it will seek European sanctions against those responsible. Iran routinely denies carrying out malicious cyber operations.
Could It Happen Here?
There may already be a U.S. connection. In August, refrigerators failed at about a half-dozen U.S. military commissaries, and Pentagon investigators are treating the malfunctions as a suspected cyberattack.
Reuters has not been able to establish whether those incidents are linked to the attacks in Europe.
The FBI is asking businesses to report any suspicious activity to the agency’s Internet Crime Complaint Center or a local FBI field office.