CISA and FBI warn of attacks on refrigeration controllers

US agencies have issued a joint warning that attackers are targeting industrial refrigeration controllers and cold-chain monitoring systems worldwide. The advisory, published by CISA in collaboration with the FBI, HHS, USDA and the Department of Transportation, notes that electronic temperature controllers used in grocery stores, cold storage facilities and refrigerated transport can be remotely manipulated.

Attacks could alter temperatures and force units into continuous heating and defrost cycles, potentially causing inventory losses, equipment hazards and safety risks to consumers. The warning identifies three initial exploitation vectors: bypassing authentication, injecting arbitrary code, and exploiting weak configurations, enabling an intruder to change setpoints and mask the resulting temperature changes.

The advisory stresses practical hardening steps and urges organisations to assume they are potential targets. Key recommendations include removing internet exposure of controller panels, or placing up-to-date gateways or firewalls in front of them; network segmentation separating OT from IT; changing default passwords, employing strong, phishing-resistant MFA where possible; updating firmware and retiring devices that are no longer supported.

Other measures include restricting changes to trusted devices and IPs, maintaining tested backups offline, enabling and reviewing logs, and monitoring network traffic for anomalous activity where devices do not record events. If suspicious activity is detected, US organisations should report to CISA’s 24/7 operations centre or the FBI’s Internet Crime Complaint Centre; healthcare organisations may contact HHS. The advisory also points to a series of mitigations and resources from CISA and the UK National Cyber Security Centre for strengthening OT security.