The FBI, CISA and other US agencies have warned that attackers are targeting industrial refrigeration and cold-chain monitoring systems. The concern extends beyond stolen data: unauthorised changes to temperature controllers can spoil food or medical supplies, damage equipment and create safety hazards. The advisory describes weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration management systems. Organisations that depend on cold storage should treat remote access and operational technology security as part of business continuity.
The warning covers exposed refrigeration controls
The joint warning from the FBI and CISA, issued with the Departments of Health and Human Services, Agriculture and Transportation, says malicious actors are targeting refrigeration controllers used in retail grocery, cold storage, healthcare, food production, chemical facilities and transportation. These systems allow operators to monitor temperatures remotely, manage defrost cycles and control cooling equipment. The agencies say attackers may exploit authentication bypass vulnerabilities, arbitrary code injection flaws or weak configurations in devices exposed to the internet.
Temperature changes can create physical and supply-chain risks
Many refrigeration controllers were designed to be managed remotely by equipment vendors or facilities teams. The same connectivity that allows temperature monitoring across several stores can expose control interfaces if they are reachable from the public internet or protected by weak authentication. Unlike a conventional IT breach, an attacker may not need to steal a database to cause damage: changing a set point or triggering a defrost cycle can affect the physical environment while the control system continues to appear operational.
That creates a response problem for operators. A cybersecurity team may be able to isolate a controller, but facilities staff must determine whether doing so will interrupt cooling, alarms or safety processes. Each site needs a documented safe operating range, a way to verify temperatures independently of the compromised interface and a procedure for switching to local or manual control. Food, medicine and other temperature-sensitive stock may require separate decisions about quarantine and disposal if records show that storage conditions were breached.
The BleepingComputer report on the agency warning describes earlier attacks against European refrigeration systems. In October, attackers reportedly compromised controllers at an estimated 250 to 350 French supermarkets, remotely activating defrost functions and raising temperatures in refrigerators and freezers. A later wave reported in November affected more than 115 stores across six European countries. Some systems shut down, while others reportedly reached temperatures as high as 50 degrees Celsius.
Federal guidance focuses on access and recovery
The agencies recommend removing refrigeration controllers from the public internet. If remote access is necessary, it should pass through a controlled gateway with strong authentication, limited privileges and monitoring. Operators should change default passwords, apply available security updates and review whether vendor accounts or remote maintenance connections are still required. Access should be limited to the people and systems that need it, and credentials should be unique rather than shared across sites.
Operators should also review the boundary between refrigeration networks and the wider corporate environment. A controller that cannot be reached directly from the internet may still be exposed through a vendor laptop, remote-support appliance or shared management server. Network segmentation should limit those paths, while remote sessions should be time-limited, attributable to an individual technician and logged centrally. These controls reduce the chance that an intrusion in an office network can become an operational incident at a cold-storage site.
Temperature histories, alarm logs and maintenance records are evidence and operational data. Preserve them during containment, compare controller logs with independent sensors and record when staff changed equipment to manual operation. That information can help establish whether products remained within required storage ranges, identify the affected period and support decisions with insurers, customers and regulators. It also helps investigators distinguish a malicious setting change from a hardware failure or routine maintenance event.
The joint warning does not say that every refrigeration operator has been compromised. It identifies an active threat to internet-accessible controllers and urges organisations to reduce exposure. The Reuters report places the warning alongside incidents involving US military-base refrigeration equipment and European supermarkets, including a reported French incident that caused tens of millions of euros in losses. The agencies have not publicly identified all the actors or disclosed a complete technical account of every incident, so the scale and common methods remain partly unclear.