CISA and FBI Warn of Global Cyber Attacks on Industrial Refrigeration and Cold Chain Controllers

CISA and the FBI, together with the U.S. Department of Health, Department of Agriculture, and Department of Transportation, released a joint advisory on November 5 warning of malicious cyber activity against industrial refrigeration and cold chain monitoring systems globally.

The primary targets are electronic temperature controllers and commercial refrigeration management systems used in supermarkets and cold storage facilities. Attackers exploit unpatched vulnerabilities or weak configurations to gain remote access to control panels.

Three main attack vectors are described: authentication bypass, arbitrary code injection, and weak default configurations. Successful exploitation allows adversaries to override normal operation and force refrigeration units into continuous heating and defrost cycles.

Consequences include shortened equipment lifespan, elevated fire risk, spoilage of temperature-sensitive stock, and potential consumer harm if compromised products are later consumed. A secondary effect known as denial of visibility prevents operators from seeing the actual system state, delaying detection of the attack.

The advisory notes that the affected systems are widely used in public health, chemical, food and agriculture, and transportation sectors, including refrigerated logistics.

Recommended Mitigations

• Remove control panels from public internet exposure and protect any required remote access with updated firewalls or edge devices.
• Implement dedicated VLANs to separate operational technology equipment from corporate networks.
• Replace default passwords, enforce strong password policies, and enable phishing-resistant multifactor authentication where feasible.
• Apply firmware updates promptly and retire unsupported equipment.
• Restrict access via allow-lists of authorized devices and IP addresses.
• Maintain regularly tested offline backups and review logs for anomalous activity.
• Define reasonable temperature thresholds with alerts for deviations.

U.S. organizations are encouraged to report suspicious activity to CISA or the FBI Internet Crime Complaint Center.