CISA and FBI warn of attacks on industrial refrigeration systems

The Cybersecurity and Infrastructure Security Agency (CISA), in coordination with the FBI and other US government partners, has urged organisations to harden industrial refrigeration and cold chain monitoring systems after reports of attackers remotely altering temperatures.

The advisory notes that “malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally” has been observed, with incidents where internet-connected refrigeration controllers were accessed and temperatures manipulated.

The warnings reference real-world impacts, including ruined food and medical supplies, and point to past events in Europe where attackers forced temperatures to extreme levels—for example, Danfoss‑administered systems being programmed to reach up to 50°C (122°F)—and similar disruptions affecting multiple countries.

The FBI and CISA emphasise that the issues affect sectors such as healthcare, chemical, food and agriculture, and transportation, where automated temperature monitoring, logging, defrost management and energy optimisation are commonplace. The joint communications describe attackers potentially exploiting unpatched or internet‑exposed controllers via authentication bypass, arbitrary code injection and weak configurations to gain remote access.

The agencies outline urgent actions for security teams, including keeping control system devices private from internet exposure, deploying firewalls or edge devices if remote access is necessary and applying the latest software versions, isolating operational technology from business networks, changing default passwords and enforcing strong, phishing‑resistant MFA, implementing lifecycle management to retire end‑of‑life devices and restricting access to authorised devices and IPs.

They also urge maintaining offline offsite backups and regular testing. Data published by Censys on 5 November shows a 53% drop in internet‑exposed refrigeration controllers across the Danfoss StoreView and Copeland/Dixell XWEB products involved in the October 11 and November 2 incidents, suggesting provider actions or owner device disconnections; no single threat actor has yet been attributed to the incidents.