CISA/FBI Advisory: Industrial Refrigeration & Cold Chain Controllers — attackers alter settings, force heating/defrost cycles
Severity: high · Patch status: unknown · Since 2026-11-09
CISA, the FBI, HHS, USDA and the Department of Transportation published a joint advisory warning of global malicious activity targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. Attackers exploit vulnerabilities in unpatched or internet-accessible controllers via authentication bypass, arbitrary code injection, or weak configurations to remotely alter settings, force units into continuous heating and defrost cycles, hide true temperatures, and cause inventory loss, equipment hazards, fire risk and potential consumer safety issues. No specific CVEs or vendors are named. Mitigations focus on removing controllers from internet exposure, network segmentation, strong credentials, MFA, firmware updates, allowlisting, backups and logging.
What to do
- Remove controller panels from internet exposure; place updated firewalls/gateways in front of any required remote access
- Segment OT/industrial equipment from office networks on a separate virtual network
- Change default passwords to strong ones and enable phishing-resistant MFA where possible
- Update firmware; retire unsupported devices; allowlist trusted devices/IPs for setting changes
- Keep tested, offline backups; enable logging and review logs (or monitor network traffic if devices don't log)
- Report suspicious activity to CISA 24/7 operations center or FBI IC3
Sources
All live incidents on Threat Watch
