Through the Line Podcast: What the Freezer Hacks Reveal About Food and Cold Chain Cybersecurity

I’m talking with Kristin King, author of “Securing What Feeds Us: Cybersecurity in Food and Agriculture.” Cybersecurity is her expertise, and we’ve talked with her before. We’re talking now because, as I’m sure everyone has seen in the news, there’s been a rash of incidents where freezers have been hacked: in the U.S. military, in grocery stores, and most recently at blood banks.

I want to stress that a lot of this is supposition. We don’t know exactly what’s happening; it’s very early days as we’re recording this, and I’m sure we’ll learn more later. But right now, Kristin, I’d like to get your take on what happened and why.

Sure. We know why it happened: The refrigerators were exposed to the internet, and they weren’t secure. That’s the easiest layman’s way to say it. If you want to get into the nitty-gritty, they weren’t behind a firewall, or the firewall wasn’t configured properly to protect the equipment. A firewall is basically a door that controls who goes in and out. You have to pass the bouncer check, if you will.

The other thing is that it turns out there were default usernames and passwords. When a technician installed the equipment for the first time, they never bothered to change them, or it just didn’t happen for some reason. A lot of the time, you can find those default usernames and passwords in the PDF manuals on the internet.

I’ve done that myself many times.

This is why printers are really evil as well.

Routers, too.

Exactly. Those were exploited. A lot of people are also pointing to outdated software from the manufacturer of these refrigerators. That might be the case, but as we know from working in operational technology and manufacturing, if it isn’t broken, don’t fix it. Even if it’s outdated, it’s still functioning for what it needs to do, and replacing things is expensive.

I’m just going to be real about this, because I’m tired of the rhetoric that we should be updating everything legacy. I don’t care if you have legacy equipment, as long as you have the right security controls around it. That’s all that matters to me. In this case, you had the worst-case scenario: legacy equipment that wasn’t secured and was exposed to the internet.

Now, I want to make it clear, and I know everybody in food understands this, that part of the reason the equipment is exposed to the internet is food safety temperature monitoring. That’s super important. That’s our product; that’s people’s health and safety. I think a lot of the cybersecurity community missed that part. They didn’t realize that was part of the reason for the monitoring, especially in the EU, where you have to track your logs. It’s the law.

But you don’t have to be connected to the internet to record those logs. It doesn’t require an internet connection; it just requires you to record them. That’s a lot easier if you have a third party monitoring for you, or third parties doing maintenance on your systems. And I think the outsourcing is also coming into question, because we don’t know who had access, when they had access, or what’s going on with that.

So there are a lot of worst-case scenarios here. But it also shows that this isn’t just a technology breakdown. It’s a people and process breakdown, too. As we were saying before we started recording: Why didn’t anybody notice that the freezer section was hot?

I was going to ask that. The temperature was, what, 50 C?

Which is 122 degrees Fahrenheit.

That’s hot.

Have you stood next to something that’s 122 degrees Fahrenheit? It’s a little warm.

I have. Some of us have, if we’ve worked around ovens in various manufacturing facilities.

It’s hot. You feel it. Your body feels it. And some of these freezers caught on fire. One thing I found quite amusing was reading the comments on LinkedIn, where people were asking, “Why is there a heater in a refrigerator or freezer?” Clearly people don’t understand what an HVAC system is. Doors open all the time. The temperature has to be controlled, and it legitimately works both ways.

It’s interesting to me, because this shows how far removed we are from the food system. We don’t understand how our food is stored, maintained, and transported to get to us. I shouldn’t laugh, because not everybody needs to understand HVAC systems. But I feel like logically you’d understand that if a refrigerator or freezer door keeps opening, it has to be cooled and heated to maintain proper temperatures for food safety. Just saying.

But it goes back to: Why didn’t anybody notice those refrigerators were hot? There would have been signs. The doors would have been fogged. You would have seen products falling down because they couldn’t hold their shape.

Ice cream melting.

Ice cream melting. Someone commented “Viva la ice cream,” and I laughed for quite a few minutes, because it’s true. We need to save the ice cream.

And on top of that, as everybody’s probably aware, the cleanup is immense. You have to completely scrub out those freezers and get rid of the product. And as everybody in the food industry knows, you can’t just dump product. You have to dispose of it safely, and especially in Europe, with sustainability and environmental laws, you can’t just toss it in the dumpster. Then who verifies whether product is still safe to sell or eat? If you didn’t have food safety temperature checks on site, I’d be concerned about anybody making that judgment call.

I’m just worried about someone who may have grabbed some shrimp out of there without noticing, “This is pretty warm,” and gone home with it.

That’s actually a good point, because a lot of seafood is frozen. That would probably have been the first to be tossed, and then anything dairy, anything with cheese.

Or meat. There’s a lot of frozen meat.

Meat. There’s a lot of concern about what happened. And if you take it to the next level, you have food security issues. Now you’ve got hundreds of grocery stores without a freezer section, which may be serving people with allergen issues or other life-sustaining dietary needs. Or there’s just no food available in general, other than fresh. I don’t think people realize how severe that is, especially for a small community where that’s the one grocery store. Or maybe the next grocery store is a couple of hours away, and it also got hit. How are people going to manage?

From a food manufacturing perspective, what does that mean for your forecast? Do you have to increase output because of this incident, or do you carry on with your normal forecast? We’re heading into the holiday season, so what does that mean for your production? If your products made up most of the food that was tossed, that’s a loss. That hurts, because now people aren’t buying your product. They might favor a different product because yours was one of the ones thrown out. There are all these second-, third-, and fourth-order effects from these incidents, and now they’re reaching into blood banks.

I do find it interesting that all of a sudden people are upset and concerned about food and agriculture because these freezers got hit. The blood banks are obviously devastating, but to me, food getting hit is just as bad, full stop.

Somebody could write a whole dissertation on the human side of what upsets people and what motivates them to do something. Like we talked about earlier, most people don’t understand what it takes to get food from the farm to the table and all the steps involved. People assume it’s a given: “My food will be in a box in the freezer, and I just go to the store and pick it up. It’s that simple.” They don’t understand all the other steps to get it to the store.

And think about the packaging. It’s not just the food in the box; it’s the box itself. Do we now have to make more boxes, more plastic liners, more of the containers that go in the freezer? There are so many secondary effects. Truck drivers and lorry drivers are probably going to be backed up, because we have to get raw ingredients into factories to speed up production, or flood the markets that were hit in Europe with replacement product.

It’s a really bad time for this to happen, because, like I said, we’re heading into the holidays, and everybody knows that’s a crazy time. I feel really bad for everyone involved: the people without food, the people who have to replace that food, the people working around it and dealing with angry customers and confusion. When something happens to food, it’s a visceral, intimate violation. And obviously blood is very intimate, too.

People are left asking: How could anyone do this? Why are these bad actors like this? How dare they? But if people have an opportunity to exploit something and make money, or to disrupt and cause chaos for whatever their end goal is, they’re going to do it. That’s just human nature. I really wish we lived in a world where everybody did the right thing, but we don’t. If we did, I wouldn’t have a job in cybersecurity.

And we don’t know what the motives were. We don’t know whether this was a group of teenagers goofing around or bad actors.

Or an [insider] incident, too. Or a combination.

It could be as simple as somebody making a mistake and flipping a switch. But it’s obviously progressed, so that’s probably not the case. Or maybe the first one was a mistake, and somebody picked up on it and thought, “Hey, I want to try this.”

Exactly. It could be state-sponsored. It could be a nation-state. It could be a group of people going, “Ha, I hacked into this; I’m the man,” or the woman, whatever. It could be a combination of both, where something was exposed and a threat actor said, “Woo-hoo.” It could be 1,000 different things at this point, and we just don’t know.

This is where we have to be careful with speculation, because these are active investigations. I want to be respectful of the people doing that work, because incident response teams are very burned out right now. There’s a lot going on. I’m concerned about people’s mental health and well-being, because any incident is very difficult to manage. I can’t imagine working in one of those stores right now and how people are feeling and dealing with it. People who don’t understand get angry. Confusion leads to anger.

So there’s definitely the people aspect. Then there are the processes. How are they going to handle this in the future? Obviously, they’ll have to secure that technology. They’ll have to clean up the burn mess. They may have to talk about having in-house security and IT teams rather than just outsourcing, or a combination of both. How are they going to do manual checks moving forward? Are they actually going to do them? Because, again, somebody could have noticed this and done something, even if it meant unplugging the freezer and moving the product out. Unplugging it would have essentially stopped the fire.

Also, why didn’t the sprinklers go off? Or if they did, did they go off for the whole store? Then the whole store is essentially destroyed. So how are we going to fix these processes? How are we going to work on business continuity and disaster recovery? This exposed so many things. It’s much bigger than “freezers got hacked.”

What’s going through my mind right now is cold chain and warehousing facilities. Again, we don’t know the motives or much about this yet. But how concerned should operators in that space be? I know you touched on this a little, but what can they do about it?

This isn’t the first time cold storage has been attacked. Americold was hit a couple of years back. I believe that was a ransomware event, and it involved full freezer warehouses, which is even worse in some ways.

I think a lot of it comes down to swallowing our pride and our shame and actually taking a look at where our connected devices are. Do we know what they’re connected to? Do we know who has access to them? That’s access control. What’s on the internet? And the third question, the most important one: Does it actually need to be on the internet, or does it just need to be on the intranet? If it only needs to be connected internally, that’s fine.

Also, what security controls are around your internet-facing devices? Do you have protocols and security controls in front of them, like a firewall? How do you manage that? Do you have a team that manages it? You obviously need a team, but do you have one? If you don’t know the answers to these questions, that’s a problem. Maybe you need to adjust your hiring, or bring in a consultant to take a look. A risk assessment obviously has to be done at this point. That’s basically what I’ve started telling people.

I know everybody goes, “Oh, an assessment. Oh, an audit.” It’s better than dealing with an incident. I’m sorry. I know it’s not the most glamorous thing to do. I actually enjoy risk assessments, but that’s because I like assessing risk. It’s not for everybody, and it does feel cumbersome. People think, “What if nothing ever happens? Then we never needed to bother.” But we pay for insurance and don’t think twice about it, right?

The other piece of that is insurance itself. Cyber insurance is great. I’m not going to tell you whether to get it, but if you have it, fantastic. However, if this turns out to be a state-sponsored, nation-state attack that’s considered an act of war, it will not be covered under your insurance. Keep that in mind.

Really?

Yes. Acts of war are not covered. There might be some negotiation around that, and I’m not sure. But as far as I know right now, acts of war aren’t covered under cyber insurance. So if it turns out to be that type of hack, it’s a bigger problem, because it’s potentially a declaration of war on wherever it happened. That gets into the political arena, which isn’t my world, but I respect the people who will have to unravel it.

The other thing you can do is better training. What I mean is: If you see something, say something. If the freezer is on fire, say something. Get a fire extinguisher. Unplug it. I laugh, but it’s sad, because a lot of people think, “That’s not my job. The building’s on fire? Eh.”

I also think this comes down to treating your employees better. You need to create a culture that allows people to be people and to actually step forward and do the right thing, or at least try to do the next right thing.

That’s what I’ll leave you with, Derek: Do the next right thing. If you feel your company is insecure, or you have questions you can’t answer, or you just have a nagging feeling, do the next right thing. Have a conversation. Talk to your board. Talk to your leadership.

I really want cybersecurity, and food safety to a degree, because they’re fighting the same fight in a different way — pathogens are hackers, just like hackers are pathogens, if you will; they mutate and change — to start being seen as a [value] center rather than a cost center. A lot of people have looked at these departments as something that just keeps the business moving and protected. I think they’d get further down the line by seeing them differently.

One thing that’s really aggravated me while reading LinkedIn and the news is all these leaders coming forward saying, “This is bad. Everybody needs to start paying attention to operational technology. Nothing should be attached to the internet.” This is guidance that’s been given for years. We’ve been saying it for 20 years. A lot of my colleagues have it in their bios: Get your stuff off the internet. It’s interesting that leadership is saying this now, when they’re the ones holding the pen on the budget, and there’s still no money going toward being proactive. They’d rather be reactive.

The food industry is famous for this: “We’re not going to invest in these things.” Then, “Oh, we got hit with ransomware. Here’s $10 million.” I don’t want you to do that. I don’t want you to pay these people or make it easy for them. Make it hard. Make them work for it.

So you should play hard to get with a hacker.

Really, yes. That’s my advice: Be hard to get for a hacker, and start having conversations. Your people are always going to be either your best or your worst asset. They’re either going to help keep this from happening, or they’re going to cause it. That’s why I keep going back to training and awareness.

Security shouldn’t be scary. Technology shouldn’t be scary. It’s a tool, like a hammer. It’s something you use to get your job done so you can go home and do whatever else you want. If you look at it like that and upgrade your tools as you need to —

Change your password.

Exactly. Make sure everything is in that locked box, if you will. That’s really all it is. It’s as simple as that. I think we overcomplicate it with different software and bells and whistles, and then it attaches to the ERP system, and so on. That’s all wonderful, but if the basics aren’t done, no hacker is going to need AI. The only thing they’ll use AI for is to scale.

Wow. Kristin, thank you so much. Your insight is always so valuable.