FBI, CISA warn of cyberattacks targeting refrigeration systems

The FBI and CISA warn that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, potentially causing food spoilage, equipment damage, and fire hazards.

The warning was issued jointly with the U.S. Departments of Health and Human Services (HHS), Agriculture (USDA), and Transportation (DOT), urging critical infrastructure operators to secure vulnerable refrigeration controllers used in healthcare, food production, chemical facilities, and transportation.

“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s Acting Executive Assistant Director for Cybersecurity.

According to a joint advisory published Thursday, attackers are exploiting weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration management systems.

These devices allow operators to monitor temperatures remotely, manage defrost cycles, and control cooling equipment.

“Globally, malicious cyber actors are targeting vulnerabilities and weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities,” CISA warned.

The agencies say attackers may exploit authentication bypass vulnerabilities, arbitrary code injection flaws, or weak configurations to modify temperature settings and force refrigeration equipment into continuous heating or defrost cycles.

Successful attacks can cause inventory losses, reduce equipment lifespan, create fire hazards, and create unsafe storage conditions. Attackers may also reduce visibility into current temperatures, preventing operators from detecting problems.

The warning follows a series of attacks against European refrigeration systems that have disrupted supermarkets and blood storage facilities.

In October, hackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets, remotely activating defrost functions and raising temperatures in refrigerators and freezers.

A second wave of attacks reported in November affected more than 115 stores across six European countries, with some refrigeration systems shutting down entirely and others raising temperatures to as high as 50°C (122°F).

On November 3, the French Blood Establishment (EFS) confirmed that a cybersecurity incident affecting a refrigeration equipment provider had altered temperature and defrost settings at three facilities used to store blood products.

In response to the ongoing threat, the U.S. agencies are urging organizations to remove refrigeration controllers from the public internet, secure necessary remote access, change default passwords, and apply available security updates.

They also recommend isolating operational technology systems from business networks and enforcing safe temperature limits to prevent controllers from operating outside acceptable ranges.