Organizations that rely on refrigeration should close off internet access to their controllers as attackers target cooling and temperature-monitoring systems worldwide, CISA and the FBI warned on November 5, 2026. Their joint warning describes attacks that could spoil stock, damage equipment and deprive operators of the temperature readings needed to spot trouble.
The guidance concerns healthcare providers, chemical facilities, food and agriculture businesses, and transportation operators, including refrigerated transport services. The agencies specifically identify electronic temperature controllers and commercial refrigeration controllers at grocery stores and cold-storage facilities as targets. Unpatched devices or controllers reachable over the internet may expose weaknesses attackers can exploit.
The U.S. Departments of Health and Human Services (HHS), Agriculture and Transportation joined the joint fact sheet. These systems do more than switch cooling equipment on and off: they let staff check temperatures remotely, retain continuous temperature records, schedule defrosting and manage energy use.
Separately reported European incidents
The U.S. fact sheet does not name these European incidents. BleepingComputer reported that attackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets in October and remotely activated defrost functions, raising temperatures inside refrigerators and freezers.
BleepingComputer reported that a second wave in November affected more than 115 stores across six European countries, leaving some cooling systems shut down entirely and others at temperatures as high as 50°C (122°F).
BleepingComputer reported that the French Blood Establishment (EFS) confirmed on November 3 that an incident involving a refrigeration equipment provider had changed temperature and defrost settings at three facilities storing blood products.
In CISA’s announcement, Acting Executive Assistant Director for Cybersecurity Chris Butera said the agency was tracking the threat with government, industry and international partners. He urged every organization dependent on refrigeration and monitoring to consider itself a potential target. FBI Cyber Branch Operations Director Brett Leatherman likewise said the bureau was seeing targeting across critical infrastructure sectors globally and urged operators to implement the guidance and report suspicious activity.
How controller access threatens stock and equipment
The agencies describe three possible routes into controllers: authentication bypass, which evades login checks; arbitrary code injection, which introduces code chosen by an attacker; and insecure configurations.
Once attackers can manipulate settings remotely, they could leave units heating or defrosting continuously. The resulting temperature changes could destroy inventory, shorten equipment life or create a fire hazard. Consumers could also suffer harm if they consume products kept under unsafe conditions.
An attack could interfere with monitoring as well as cooling. The fact sheet calls the loss of current temperature readings a “denial-of-view” condition: operators lose visibility into the conditions their equipment is maintaining.
Close remote access gaps and enforce safe operating limits
The agencies call for immediate action, with recommendations aligned to the Cross-Sector Cybersecurity Performance Goals developed by CISA and the National Institute of Standards and Technology. Those goals establish a minimum set of recommended protections.
Owners and operators should first locate systems exposed to the internet and remove that exposure, especially for controller panels. Disable remote access that serves no necessary purpose. For connections that must remain, put a firewall or edge device—the equipment protecting the network boundary—in place and update it to the latest version.
Keep refrigeration controls apart from business networks. The guidance recommends a dedicated virtual local area network, or VLAN, to separate operational technology—the systems controlling physical equipment—from ordinary business systems. Maintain lists of permitted devices and IP addresses so that only authorized systems can make changes.
Replace default passwords, require stronger passwords through enforced policies, and introduce phishing-resistant multifactor authentication wherever feasible. This adds authentication beyond a password using methods designed to resist fraudulent login sites. Keep controller firmware, the software embedded in the device, current. Establish a managed process to identify, retire and replace equipment that has reached end of life and no longer has manufacturer support.
For detection, enable activity logs and review them regularly for unexpected behavior. If equipment provides no logs, or its logs use non-standard formats, collect network traffic and communications between the devices. Maintain current backups both offline and offsite, and test them.
Operators should also set reasonable limits on the target temperatures that devices downstream of controllers can accept, then configure alerts when conditions stray outside safe ranges.
U.S. organizations should report suspicious or criminal activity to CISA’s round-the-clock Operations Center at [email protected] or 1-844-729-2472, or to the FBI through its Internet Crime Complaint Center or a local field office. Include, where available, the incident’s date, time and location; the activity and equipment involved; the number of people affected; and the reporting organization’s name and designated contact.
Healthcare organizations needing assistance with potential care disruptions from health and medical supply-chain impacts can contact HHS at [email protected] or its 24-hour Operations Center at 202-619-7800.
