US Agencies Warn of Attacks on Refrigeration Controllers

The US government agencies CISA, the FBI, HHS, the USDA and the Department of Transportation are urging organisations in healthcare, chemical, food and transportation sectors to harden their industrial refrigeration and cold chain monitoring systems.

They warn that malicious actors have recently targeted electronic temperature controllers and commercial refrigeration controllers in retail and cold storage facilities across Europe, with attackers tampering with fridges and freezers to cause inventory losses and equipment hazards. The report notes a first wave in October, when hundreds of supermarkets had temperatures pushed to 50°C (122°F) and freezers were defrosted, spoiling food and triggering fires in some cases.

A second wave this week affected more than 100 European supermarkets and a blood bank, but only the supermarket operations suffered losses; French staff actions helped protect blood products, according to the French Blood Establishment (EFS).

The agencies say attackers may exploit unpatched or internet-facing controllers to remotely alter settings, forcing devices into heating and defrost cycles. They point to methods such as authentication bypasses, code injections and weak configurations to access management systems. Internet intelligence firm Censys found 6,695 internet-exposed refrigeration controllers on 9 October; by 5 November, 3,124 remained web-accessible (47%), with exposure declines in Copeland/Dixell XWEB and Danfoss StoreView controllers.

Practical responses urged include disconnecting control systems from the internet where possible, or protecting web access with firewalls or edge devices, plus isolating OT devices, restricting access to trusted identities, enforcing strong passwords and phishing-resistant MFA, keeping systems updated, maintaining offsite backups, and enabling logging and monitoring.