The IT Nerd

The Pentagon is investigating a suspected cyberattack involving refrigeration systems at at least six U.S. military bases, according to Reuters.

The malfunctions occurred in August at military commissaries, where freezer temperatures unexpectedly increased, spoiling food. At Fort Huachuca in Arizona, officials reported that a freezer entered defrost mode overnight, heating its contents rather than maintaining safe storage temperatures.

The investigation follows a confirmed cyberattack on commercial refrigeration systems at more than 350 establishments in France earlier this month.

Damon Small, Board Member, Xcape, Inc.

“Compromising industrial refrigeration systems transforms routine facility hardware into an immediate operational liability, spoiling vital food supplies and disrupting logistics across military bases. While refrigeration devices may seem an unlikely target, the reality of the situation is that attackers are often opportunistic. The question we have to ask is whether these and other incidents against industrial cooling units are targeted to cause panic and damage, or if it is simply a matter of adversaries finding a new attack path. With similar attacks recently targeting healthcare organizations, this trend is having a chilling effect (pun intended) on operational technology security. Aside from the weak authentication and identification mechanisms featured in these industrial units, the fact that they are accessible from the Internet remains the primary concern. In short, if the question is who would want to attack a freezer, the answer, apparently, is lots of people.”

“Critical Takeaways:

• Opportunistic exposure over advanced capability: Industrial control systems frequently suffer from weak authentication and legacy identity mechanisms, making any unit reachable from the public Internet an easy mark for threat actors.
• Cascading operational disruption: Whether spoiling commissary provisions across defense installations or compromising temperature-sensitive pharmaceuticals in healthcare facilities, cooling failures yield immediate physical consequences.
• Mandatory perimeter isolation: Security teams must immediately audit facilities networks to remove refrigeration controllers from direct Internet exposure, isolate operational technology on dedicated segments, and enforce strict access controls.

“Attackers may not care about commissary breakfast menus, but they will happily exploit any exposed thermostat that responds to default credentials.

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock

“The pattern here is getting hard to miss at this point. Nichirei Logistics in Japan this summer, 700 French supermarkets through Danfoss controllers earlier this month, and now suspected activity at six U.S. military commissaries, with one freezer entering defrost mode overnight exactly like the attack in France.

“The question for investigators is whether this is the same actor working through different sectors, whether the technique has spread far enough that multiple groups are picking it up independently, or just a coincidence.

“This pattern impacting military bases takes the concern to another level. Spoiled food sounds minor, but the same access that defrosts a freezer could do a lot worse at a military base that runs on cold storage for medical supplies, blood, or really anything else relying on temperature control. Any operator still running internet-reachable refrigeration controllers at this point should get ahead by finding every reachable controller in their environment this week and either disconnecting them from the public internet or putting them behind a VPN.”

ㅤ

Steven Swift, Managing Director, Suzu Labs

“We probably won’t, and shouldn’t get additional detail regarding the potential to freezer tampering as a cybersecurity attack. Reports thus far are that freezer temperatures were unexpectedly set to defrost, and that it was a “potential cyberattack”

“In a similar 2022 attack against supermarkets, they had been using obsolete versions of cold storage controllers. IOT devices such as these are famously insecure, out of date devices even more so. There’s just not enough incentive for manufacturers to invest much into security, no one is making purchasing decisions based on how secure they think their refrigerator is.

“Many of these devices were never intended to be connected to the public internet. It matters a lot less if a device is insecure, if its only accessible locally. It’s just a much smaller attack surface. However, lots of these devices are getting connected to the internet, which suddenly makes those vulnerabilities matter.

“We don’t have any way to know if this was actually a cyberattack. Its pretty easy to blame issues on “the hackers must have done it” for what could have also been either human error, or a glitch in the system. Especially so for infrastructure which is typically insecure.”

ㅤ

Jermaine Logan, Staff Product Security Engineer, Finite State

“If these turn out to be cyberattacks, the lesson isn’t that freezers are fragile. It’s that the software inside everyday equipment is rarely something the buyer can actually see. Our own work showed how much is sitting in a refrigeration controller’s firmware. Buyers with serious stakes, the DoD included, should be demanding that visibility from device makers before deployment, not reconstructing it after the food spoils.”

Freezers are to be considered critical infrastructure. So you should take the same precautions that you do take with critical infrastructure. You do take precautions with critical infrastructure, do you?