Research · 4 min read
CISA and the FBI say attackers are targeting refrigeration controllers
A November 5 fact sheet says exposed or unpatched cold-chain controllers can be pushed into continuous defrost. The agencies do not name victims or a malware family.
On November 5, 2026, CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation published a fact sheet about attacks on the controllers that keep commercial fridges and freezers at the right temperature. The agencies say the activity is global. They do not name a victim, a company, or a piece of malware. What they describe is an attacker who can reach an internet-facing controller and change what it does.
What the agencies say is happening
The fact sheet, marked TLP:CLEAR so it can be shared, says the authoring agencies are aware of malicious activity against industrial refrigeration and cold-chain monitoring systems. Hospitals, chemical sites, food and agriculture, and transport all use them, including refrigerated trucks. The systems watch temperatures, log them, run defrost cycles and manage energy.
The threat section is more specific, and it is written as capability, not as a finished case file. Actors are targeting electronic temperature controllers and commercial refrigeration controllers in grocery stores and cold storage. They may use an authentication bypass, code injection, or a weak configuration on a controller that is unpatched or reachable from the internet. If that works, the agencies say the attacker could force units into continuous heating and defrost cycles. The effects they list are:
- a shorter service life for the equipment
- a fire hazard
- loss of inventory
- harm to people who later consume food or medicine that was stored unsafe
- loss of visibility into the current temperature, so staff cannot see that something is wrong
CISA’s acting executive assistant director for cybersecurity, Chris Butera, said every organisation that depends on these systems should assume it could be a target. FBI Cyber Branch operations director Brett Leatherman said the bureau is seeing the systems targeted across critical infrastructure sectors globally, and that inventory and equipment are at risk. Neither statement, nor the fact sheet, gives a count of sites, a country-by-country breakdown, or a confirmation that any particular store’s food was affected.
That is the limit of the document. It is a warning about a class of equipment and a set of weaknesses, with conditional language (“may”, “could”). It is not a list of breaches, and it is not a named ransomware or botnet report. News coverage the same day described supermarket and blood-bank incidents in Europe. Those details are not in the fact sheet or the agencies’ news release, so they are not repeated here.
What they ask operators to do
The mitigations follow CISA and NIST’s Cross-Sector Cybersecurity Performance Goals. In short:
- Take controller panels off the public internet. If someone has to reach them remotely, put a firewall or an up-to-date edge device in front.
- Put the operational gear on its own network, separate from the office network.
- Change default passwords, use stronger ones, and add phishing-resistant multi-factor authentication where the device allows it.
- Patch firmware, and retire controllers the vendor no longer supports.
- Allow only known devices and addresses to change settings.
- Keep backups offline and test them.
- Turn on logging, or collect network traffic where the device has no useful logs, and set alarms when a temperature setpoint leaves the safe range.
The fact sheet points operators who need the longer versions to CISA’s guidance on operational technology, edge devices and cutting internet exposure, and to the UK National Cyber Security Centre’s secure-connectivity principles for operational technology.
U.S. organisations are asked to report suspicious activity to CISA at contact@cisa.dhs.gov or 1-844-729-2472, or to the FBI’s Internet Crime Complaint Center or a local field office. Health-sector disruptions can also go to HHS at HHSCyber@hhs.gov or 202-619-7800. The agencies ask for the date, time and location, the type of activity, how many people were affected, the equipment involved, and a point of contact.
What this means if you do not run a cold room
If you shop for groceries or pick up a prescription, you cannot patch the store’s controller, and this notice does not say your food was involved. There is no consumer checklist that follows from the fact sheet. The people who can act are the ones who own or maintain the equipment: a grocer, a clinic, a warehouse, a trucking firm, or the vendor who installed the monitor.
If that is you, the first question is whether the controller’s admin page answers on the public internet. If it does, the fact sheet’s first step is to remove that exposure before debating the rest.
How Frame helps
Frame does not monitor building controls or refrigeration equipment. This notice is not a breach of personal data. Nothing in it belongs in a breach catalog.
Sources
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.