CISA, the FBI, HHS, USDA, and the Department of Transportation have warned that hackers are targeting industrial refrigeration and cold chain monitoring systems worldwide. The warning says food, medicine, and other temperature-sensitive goods are at risk, and it was issued on November 5, 2026.
The joint federal fact sheet covers systems used in healthcare, chemicals, food production, agriculture, and transport, including refrigerated delivery services. It also says malicious activity has been directed at electronic temperature controllers and commercial refrigeration controllers in grocery stores and cold storage facilities.
How attackers can reach the controllers
The fact sheet says attackers may use unpatched software, weak settings, or internet-accessible devices to gain remote access and alter how cooling equipment works. It lists three possible entry points: authentication bypass, arbitrary code injection, and weak configurations. Authentication bypass allows attackers to skip login checks, while code injection can let them run commands on affected systems.
The warning does not name specific attackers, affected vendors, or individual CVEs. After gaining access, hackers could force refrigeration units into continuous heating or defrost cycles. The resulting temperature changes could ruin stored goods, shorten equipment life, and create fire hazards.
Potential effects at stores and facilities
Consumers could also be harmed if products reach them after unsafe storage. The fact sheet says these are potential effects, not confirmed outcomes across every targeted facility. It also says attackers could create a denial-of-view condition, which would leave operators unable to see current temperatures.
That loss of visibility creates a separate risk because staff may no longer have the information needed to judge whether stored products remain safe. The warning follows reported supermarket refrigeration attacks across Europe, where altered temperature controls forced retailers to remove chilled and frozen food from sale. The federal fact sheet does not explicitly connect its findings to those incidents.
Research and response guidance
Earlier research into Copeland refrigeration controller flaws showed how compromised equipment could affect cooling and temperature readings. That research involved specific products and does not prove the entry points used in the current activity.
The agencies recommend removing refrigeration control systems from direct internet access. If remote access is necessary, operators should place it behind a firewall or edge device and keep that equipment updated. Dedicated operational technology networks should separate refrigeration devices from business systems.
They also say operators should replace default passwords, enforce strong credentials, and use phishing-resistant multifactor authentication wherever possible. Firmware updates remain essential, along with plans to retire equipment that no longer receives vendor support. Access should be limited to approved devices and IP addresses, and facilities should maintain tested offline backups, review logs, and collect network traffic where controller logs are unavailable.
The warning says safe temperature limits and alerts for unexpected changes can help staff detect dangerous conditions. U.S. organizations should report suspicious activity to CISA, their local FBI office, or the FBI’s Internet Crime Complaint Center.
Licensed under CC BY-ND 4.0 International