Commercial Refrigeration Cyberattacks Signal New Challenges Coming for US Distributors

Recent cyberattacks on refrigeration systems in Europe highlight a new concern for the U.S. commercial refrigeration industry. Ensuring technicians are trained on proper IT procedures for commercial systems could become a requirement for major retailers looking to avoid the same inventory losses seen in Europe.

What Happened in Europe?

In late October, hundreds of French supermarkets reported refrigeration disruptions after hackers turned on system defrost cycles, raising temperatures to nearly 125°F (50°C) and ruining store inventories nationwide. In early November, retailers in several other European countries reported similar incidents, including new targets like blood banks. Attackers accessed supervisory controllers and changed temperature or defrost settings.

Investigators have not determined who was responsible or whether the incidents were part of a single campaign. France’s CERT-FR reported compromises involving Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB systems.

The United States Department of Defense is investigating a separate case from August where refrigeration failures affected at least six military commissaries. Reuters reported that the Pentagon is treating the incidents as a suspected hack. Officials have not publicly determined the cause or connected the cases to the attacks in Europe.

What Is the Cause?

Investigators are pointing to controllers exposed directly to the internet, left with default passwords, or running outdated software as the pathway hackers used to get into the system.

Manufacturers are issuing security guidance, and distributors should make sure that guidance reaches the contractors who service these systems. Contractors can then help customers determine which controllers they have, whether remote access is properly secured, and whether firmware updates or other manufacturer recommendations apply.

Customers also need a plan for a refrigeration disruption, including procedures for temperature alarms and ensuring technicians know how to verify IT settings and contact the manufacturer if a controller may be compromised.

What Can You Do?

A refrigeration system can be mechanically sound and still be put out of operation through its controls. The attacks in Europe remind us that protecting equipment now includes protecting access to it. Distributors should pass along manufacturers’ security updates, and contractors should help customers put that guidance into practice.

Distributors can also work with their OEM suppliers on updated technical training on IT security for systems with internet access.

Questions?

If you have questions, please reach out to Alex Ayers.

Stay up to date on the latest Government Affairs and Advocacy updates by subscribing yourself or your company's key contact for these issues. Get the latest Federal and State issues information impacting the HVACR industry.