FBI and CISA Warn That Attackers Are Targeting Refrigeration Controllers

Five US government partners issued a joint warning on November 5, 2026. The Cybersecurity and Infrastructure Security Agency (CISA) signed it. So did the Federal Bureau of Investigation (FBI). The Department of Health and Human Services (HHS) signed it too. The Department of Agriculture (USDA) and the Department of Transportation (DoT) signed it as well. The warning covers industrial refrigeration and cold chain monitoring systems. The Internet Crime Complaint Center (IC3) published it as a joint Cybersecurity Advisory (CSA).

The message is plain. Malicious cyber actors target electronic temperature controllers. They also target commercial refrigeration controllers. The targets sit in retail grocery stores and cold storage facilities around the world. These are operational technology (OT) devices. They control real temperatures in real rooms. A cyber attack on one can spoil food and put people at risk.

How attackers get in

The advisory names three ways in. The first is authentication bypass. The second is arbitrary code injection. The third is weak configurations. None of these needs a new flaw. A controller left on the public internet is enough. A default password left in place is enough. A weak setup gives an attacker a path to the setpoint.

The advisory names no vendor. It gives no victim counts. It attributes the activity to no group and no country. That restraint matters. The warning is about the exposure, not about one brand of controller.

What an attack can do

The advisory lists six effects. An attacker can change the temperature. That can spoil inventory and shorten the service life of the equipment. A bad change can create a fire hazard. Staff can lose sight of current temperatures. Consumers can face indirect harm from food stored at unsafe temperatures. The harm is physical, not just digital. A wrong number on a controller becomes warm milk, spoiled meat, or ruined blood products.

Reporting adds scale to the warning. Reuters, via TechCrunch and BleepingComputer, reported an October 12 wave that hit an estimated 250 to 350 French supermarkets. Attackers remotely activated defrost and raised temperatures. A second wave in early November affected more than 115 stores across six European countries. Some units reached 50 degrees Celsius. On November 3, the French Blood Establishment confirmed an incident affecting refrigeration at three facilities storing blood products. The US Department of Defense is investigating suspected hacks at military base freezers. These wave details come from reporting, not from the advisory. The advisory itself gives no victim counts.

What to do now

The advisory lists clear mitigations. Start with exposure. Eliminate public internet exposure for these controllers. Isolate OT devices on a dedicated virtual local area network (VLAN). Then fix the logins. Change default passwords. Enforce strong password policies. Use phishing resistant multi-factor authentication (MFA) where feasible. Apply patches when they exist. Retire end of life devices that no longer get fixes. Allowlist only the Internet Protocol (IP) addresses and devices that need access. Keep current offsite and offline backups. Turn on logging. Review setpoint ranges so a bad change stands out fast.

Each step is simple. Together they close the path the advisory describes. An attacker who cannot reach the controller cannot change its setpoint. An attacker who cannot log in cannot inject code. A team that watches logs and setpoint ranges can spot a bad change before food spoils.

The compliance lesson

This warning is a boundary lesson. OT controllers often sit outside the system inventory. They sit outside the authorization boundary. They sit outside the monitoring plan. That gap is the risk. A controller that controls temperature is part of the system. It belongs in the inventory. It belongs inside the boundary. It needs the same proof as any server. Teams should list each controller, record its firmware, and show how it is isolated and logged. PolicyCortex does not patch controllers. PolicyCortex helps teams link proof to requirements.

Next step

Check one site this week. List every refrigeration controller. Confirm none is on the public internet. Change every default password. Record the date and the result.

Sources

• CISA, FBI, HHS, USDA, DoT, "US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems," IC3 joint Cybersecurity Advisory, November 5, 2026, https://www.ic3.gov/CSA/2026/261105.pdf
• Reuters via TechCrunch and BleepingComputer, reporting on the October and early November waves, the French Blood Establishment incident, and the US Department of Defense investigation.
• Original diagram by PolicyCortex.