Refrigeration cyberattacks trigger FBI and CISA warning

Refrigeration cyberattacks are targeting the systems that control and monitor cold storage worldwide, the FBI and CISA warned on November 5. Attackers can remotely activate defrost cycles or change temperature settings, putting groceries and blood products at risk before staff notice a problem.

Attackers can change temperatures and disrupt monitoring

The joint advisory, which also came from the U.S. Departments of Health and Human Services, Agriculture and Transportation, focuses on electronic temperature controllers and commercial refrigeration management systems. Operators use these devices to check temperatures remotely, adjust cooling and schedule defrost cycles. However, some facilities expose their controllers to the public internet or run software that lacks security updates.

According to the agencies, attackers can exploit flaws that let them bypass sign-in checks or run code on a controller. Weak configurations can also give them access. Once inside, an attacker can force equipment to keep heating or defrosting. Prolonged operation under those conditions can spoil stock, shorten equipment life and create a fire hazard.

Attackers can also interfere with temperature monitoring. As a result, staff may lose access to reliable readings just when they need to decide whether they can safely keep goods in storage.

European incidents hit supermarkets and blood storage sites

In October, attackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets. They remotely activated defrost functions, causing temperatures to rise in refrigerators and freezers. A second wave of refrigeration cyberattacks reported in November affected more than 115 stores across six European countries. Some systems shut down entirely, while others reached temperatures as high as 50°C (122°F).

On November 3, the French Blood Establishment confirmed that a cyber incident at one of its refrigeration equipment providers had affected three facilities that store blood products. The incident altered both temperature settings and defrost schedules at those sites.

Agencies urge operators to restrict remote access

The agencies advise operators to remove refrigeration controllers from the public internet and secure any remote connections they still need. They also recommend changing default passwords and applying available security updates. These measures apply across the cold chain, from food production and retail to healthcare, chemical storage and transportation.

For facilities that connect cooling equipment to a wider network, the advisory recommends separating refrigeration controls from business systems. The agencies also urge operators to enforce safe temperature limits so controllers can only operate within the range the facility allows.