· · · ·

CISA and FBI Warn of Attacks on Refrigeration Controllers

Five U.S. agencies warned Nov. 5 that attackers are targeting industrial refrigeration and cold-chain controllers in grocery stores and cold storage.

ByPeter
Rows of metal shelves holding labeled glass jars of seeds inside a cold-storage genebank
Photo by Luigi Guarino (CC BY 2.0)

WASHINGTON — Five U.S. agencies said on Nov. 5, 2026, that they are aware of malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems around the world.

The Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation published a joint fact sheet urging owners and operators to take those systems off the public internet where possible, protect any remote access that remains necessary, and keep firmware up to date.

What the agencies reported

The authoring organizations said organizations in the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors widely use these systems, including in refrigerated transport, for automated and remote temperature monitoring, continuous logging, defrost cycle management and energy optimization.

They said malicious cyber actors are targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. The actors “may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards,” the fact sheet said.

The agencies listed three possible routes in: authentication bypass, arbitrary code injection and weak configurations. If those flaws are exploited, they said, an attacker could change temperatures in ways that shorten equipment life, create a fire hazard, cause inventory loss, or indirectly harm consumers if products are eaten after unsafe storage. They also warned of a “denial-of-view condition,” in which operators lose visibility into current temperatures.

The U.S. advisory does not name a perpetrator, a product or a country of origin.

Reported incidents in Europe

The U.S. fact sheet describes the activity as global and does not recount individual cases. Separate reporting in Europe has described attacks on supermarket refrigeration and on equipment used by France’s national blood service.

Franceinfo reported that the Établissement français du sang confirmed a cybersecurity incident on Nov. 2, 2026, involving a refrigeration equipment provider. According to the EFS statement quoted by Franceinfo, supervision and control systems for cold rooms at three EFS sites were altered, with temperature and defrost thresholds set very high. The cold rooms stored plasma for transfusion or for fractionation into medicines, Franceinfo reported. The EFS said its own alarms identified the anomalies quickly, that no blood products were lost or altered, and that no health impact was identified.

Help Net Security, writing about the U.S. advisory, said the warning followed a series of European refrigeration attacks, including incidents that left French supermarkets with spoiled stock and later waves reported in several other European countries. BleepingComputer similarly reported that the U.S. warning followed European supermarket disruptions and the EFS incident. Those European case details are not in the U.S. fact sheet.

What operators are told to do

The agencies said their recommendations align with the Cross-Sector Cybersecurity Performance Goals developed by CISA and the National Institute of Standards and Technology. The first item is to eliminate public internet exposure of control-system devices, “particularly controller panels.” If remote access is necessary, they said, it should sit behind a firewall or edge device that is kept updated.

Other steps listed in the fact sheet include isolating operational technology devices on a dedicated network segment; changing default passwords and using phishing-resistant multifactor authentication where feasible; keeping firmware current and retiring unsupported equipment; limiting who can make changes through device and IP allowlisting; maintaining tested offline backups; enabling logging; and setting safe setpoint limits with alerts for deviations.

The same document points operators to CISA’s Binding Operational Directive 26-04, which directs federal civilian agencies to prioritize security updates based on risk, including whether a system is publicly exposed and whether a vulnerability appears in CISA’s Known Exploited Vulnerabilities catalog. The advisory also directs U.S. organizations to report suspicious activity to CISA and to the FBI’s Internet Crime Complaint Center.

What it means

Analysis: The agencies are treating internet-reachable refrigeration controllers as an operational-technology problem with public-health consequences, not only an information-technology outage. The fact sheet does not say how widespread the activity is inside the United States, and it does not attribute the attacks. What it does say is that owners should assume exposed controllers can be altered remotely and should remove that exposure.

Sources

Additional sources

Related coverage

Related on Peter’s World

Recommended articles