U.S. Agencies Warn of Cooling-Control Attacks at European Sites

Key points

• U.S. government agencies issued a warning about attacks on cooling-system controls.
• European supermarkets and blood banks are named as targets.
• No CVE is tied to the activity; exposure and weak hardening are the concern.
• Operators should cut public access and tighten device security.

U.S. federal agencies have flagged a campaign in which malicious actors pursue internet-reachable temperature-control equipment used by European grocery chains and blood-collection centers. The focus is on controllers that manage chillers and freezer units, not on a single software flaw. No CVE has been assigned.

Affected organizations include supermarkets and blood banks across Europe. For grocery operators, manipulation could disrupt cold storage and business continuity. For blood services, temperature integrity is tied to product safety and regulatory compliance. The advisory's scope is Europe, but similar exposure patterns can appear anywhere.

Cooling controllers often sit at the boundary between operational technology and corporate IT, are deployed for years, and may retain default credentials or remote-access paths. Attackers do not need a novel exploit if devices are publicly reachable. The absence of a CVE does not mean low risk; it shifts attention to configuration, network placement, and monitoring.

U.S. agencies are urging operators to harden controllers. That means reducing internet exposure, segmenting cooling systems, and watching for anomalous logins or setpoint changes. Vendors and facility teams should confirm remote support is authenticated and logged.

What to watch: temperature alarms that are disabled or ignored, unexpected configuration changes, new remote-access accounts, and scanning against controller management interfaces. Blood banks and grocery chains should test fail-safe alarms and manual override procedures.

What to do now

1. Inventory every internet-reachable refrigeration and freezer controller, including vendor-managed units, and assign an owner.
2. Remove direct public exposure; place controllers behind a VPN or zero-trust gateway and block unsolicited inbound access.
3. Replace default credentials, enforce unique passwords, and enable MFA where the controller or gateway supports it.
4. Apply the latest vendor firmware or software updates; if no fix exists, isolate the device on a restricted segment.
5. Segment cooling systems from corporate IT and limit outbound traffic to only required management endpoints.
6. Enable logging and alerts for logins, configuration changes, and temperature setpoint changes; test fail-safe alarms.
7. Review vendor remote-support paths and require approval, logging, and time-bound access.

Original source

SecurityWeek