Hackers Are Heating Up Freezers. Is Anything in Your Business Next?
This week the FBI and CISA, along with three federal departments, put out a warning that sounds almost silly until you think about it: hackers are breaking into internet-connected freezers and refrigerators and cranking up the heat. The result is spoiled food, ruined inventory, and in one case, a blood bank that had to scramble to protect donated blood.
If you run a restaurant, a shop, a clinic, or a small office, this is not a story about someone else’s problem. It is a story about every device you own that quietly connects to the internet.
What actually happened
According to TechCrunch’s report on the warning, attackers have been hijacking remote-controlled refrigeration and cold-chain systems. Supermarket coolers, military base freezers, and at least one blood bank have been hit. In Europe and the UK, two waves of attacks pushed temperatures up in a dozen countries. Some of the affected units came from a manufacturer that had stopped sending security updates to its customers.
Federal agencies say attackers can force these machines into constant heating and defrost cycles. That ruins what is inside, and it can wear out the equipment or even create a fire hazard. BleepingComputer covered an earlier wave that hit French supermarkets.
Why this matters to a small business
Think of it like a back door nobody remembered
Picture a building where the front door has a great lock, but a side door was added years ago for a delivery and never locked. Nobody uses it, so nobody thinks about it. Internet-connected equipment is that side door. The freezer controller, the thermostat, the security camera, the badge reader, the printer. Someone set it up once so a vendor could check it remotely, and then everyone forgot.
Old gear is the easiest target
When a manufacturer stops updating a product, every new flaw stays open forever. Attackers know this and search the internet for exactly those devices. They do not need to know who you are. They just need your equipment to be reachable.
The damage is not just digital
A hacked laptop costs you data. A hacked freezer costs you a week of inventory. For a restaurant, a grocery, a medical office with supplies on ice, or a lab, that is real money and sometimes real safety.
What the government told businesses to do
The advice is simple and none of it is exotic. Take remote control systems off the open internet. Change and strengthen passwords. Install patches where you can. Retire equipment the vendor no longer supports. CISA’s acting cybersecurity chief said every organization that depends on these systems should assume it could be a target.
What you can do this week
- Make a list. Walk your location and write down every device that connects to the internet or Wi-Fi: coolers, thermostats, cameras, door controls, printers, and anything a vendor monitors remotely.
- Change default passwords. If a device still uses the password it shipped with, it is a gift to attackers. Use long, unique passwords stored in a password manager.
- Ask vendors one question. “Is this controller reachable from the open internet, and do you still send security updates?” Get the answer in writing.
- Close the side door. Remote access should go through a secured connection with multi-factor login, not an open port on your router.
- Separate the devices. Put equipment like coolers and cameras on their own network, apart from the computers that hold customer and payment data.
- Plan the replacement. If a device no longer gets updates, budget to replace it. Until then, take it off the internet.
- Have a backup plan. Know what you would do if a cooler failed at 2 a.m. A temperature alarm that does not depend on the same network is cheap insurance.
The bottom line
Cybersecurity used to mean protecting computers. Today it also means protecting the freezer, the thermostat, and the camera over the door. You do not need to become an expert. You need a list, better passwords, and a plan for old equipment. That alone puts you ahead of most of the businesses attackers go after.
At Incognito Cyber Security we help small businesses across Southern Arizona find these forgotten doors and close them. Our small business cyber security solutions start with a simple review of what is connected. Pair that with endpoint protection, cybersecurity awareness training for your staff, and secure data backups, and you have real layers. Our spam and virus filtering also stops many of the phishing emails that start these attacks. If you missed our recent post on patching your office router and firewall, it pairs well with this one, and you can find more on our blog.
Not sure what is connected in your business?
Book a complimentary visit and we will walk through your devices, networks, and risks with you. Book your visit →
Send us a message
— Nemuel Cruz, Incognito Cyber Security
