FBI and CISA warn of attacks on refrigeration and cold-chain systems

The FBI and CISA, jointly with the U.S. Departments of Health and Human Services, Agriculture and Transportation, say attackers are exploiting weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration management systems. According to the joint advisory, attackers may modify temperature settings and force equipment into continuous heating or defrost cycles, causing inventory losses, shorter equipment lifespan, fire hazards and unsafe storage conditions.

BleepingComputer reports that in October, hackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets. A second wave reported in November affected more than 115 stores across six European countries, with some systems shutting down and others raising temperatures to as high as 50°C (122°F). On 3 November, the French Blood Establishment (EFS) confirmed that a cybersecurity incident affecting a refrigeration equipment provider had altered temperature and defrost settings at three facilities storing blood products.

The agencies urge operators to remove refrigeration controllers from the public internet, secure necessary remote access, change default passwords, apply available security updates, isolate operational technology systems from business networks and enforce safe temperature limits.

Why it matters Attacks on refrigeration controllers turn an intrusion into physical harm: spoiled stock, damaged equipment, fire hazards and, as the incident at the French Blood Establishment shows, a risk to stored blood products. The agencies' advice points to the weak spots: controllers reachable from the internet, default passwords and missing security updates. Organizations that run cold storage, from supermarkets to blood services, should count these controllers as part of their attack surface: take them off the public internet, secure remote access and keep them apart from business networks.