The FBI and CISA have jointly warned that malicious actors are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide. The advisory was issued alongside the U.S. Departments of Health and Human Services (HHS), Agriculture (USDA), and Transportation (DOT), and it is aimed at critical infrastructure operators in healthcare, food production, chemical facilities, and transportation. Successful attacks could lead to food spoilage, equipment damage, and fire hazards.

What the attackers are doing

According to the joint advisory, attackers are exploiting weaknesses in electronic temperature controllers and commercial refrigeration management systems that are either unpatched or reachable from the internet. These devices let operators monitor temperatures remotely, manage defrost cycles, and control cooling equipment.

The agencies say attackers may use authentication bypass flaws, arbitrary code injection, or weak configurations to change temperature settings. Forcing equipment into continuous heating or defrost cycles can cause inventory losses, shorten equipment life, create fire risks, and produce unsafe storage conditions. Attackers may also limit visibility into current temperatures, which keeps operators from noticing problems.

Recent European incidents

The warning follows a series of attacks on European refrigeration systems. In October, hackers reportedly compromised refrigeration controllers at an estimated 250 to 350 French supermarkets, remotely activating defrost functions and raising temperatures in refrigerators and freezers. A second wave reported in November affected more than 115 stores across six European countries, with some systems shutting down entirely and others raising temperatures as high as 50°C (122°F).

On November 3, the French Blood Establishment (EFS) confirmed that a cybersecurity incident at a refrigeration equipment provider had altered temperature and defrost settings at three facilities used to store blood products.

Recommended defenses

The agencies urge organizations to take the following steps:

  • Remove refrigeration controllers from the public internet and secure any required remote access.
  • Change default passwords on all controllers and management systems.
  • Apply available security updates promptly.
  • Isolate operational technology systems from business networks.
  • Enforce safe temperature limits so controllers cannot operate outside acceptable ranges.

Operators in healthcare, food retail, and cold storage should treat refrigeration controllers as a potential target and review their exposure now.