The Cybersecurity and Infrastructure Security Agency (CISA) and four federal partners warned Nov. 5 that malicious cyber actors are targeting industrial refrigeration and cold chain monitoring systems worldwide. They urged operators to remove exposed controls from the public internet and strengthen remote access security.
“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” CISA Acting Executive Assistant Director for Cybersecurity Chris Butera said in a press release.
Healthcare, chemical, food and agriculture, and transportation organizations rely on these systems to monitor temperatures, manage defrost cycles, and protect temperature-sensitive products during storage and transport, the agencies noted.
CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture, and the Department of Transportation said attackers could exploit unpatched or internet-accessible controllers to change settings and force equipment into continuous heating and defrost cycles.
Potential consequences include inventory losses, fire hazards, shortened equipment life, and harm to consumers who use products stored at unsafe temperatures.
Attackers could also prevent operators from seeing current temperatures, making it harder to identify unsafe conditions, the agencies warned.
The alert follows documented incidents in Europe. In a Nov. 4 joint statement, the European Commission and the European Union Agency for Cybersecurity said refrigeration systems and similar devices had been affected by cybersecurity incidents in multiple member countries since Oct. 11.
In the United States, Reuters reported Oct. 29 that the Defense Department (DOD) was treating August freezer malfunctions at military commissaries as suspected hacking. The news agency identified at least six affected stores through installation announcements but said it could not establish whether investigators had determined the cause or responsibility.
DOD told Reuters that a Cyber Command unit was coordinating with interagency and law enforcement partners.
John Harmon, regional vice president of cyber solutions for global public sector at Elastic and a former global network analyst at the National Security Agency, said agencies should assess connected equipment with facilities staff and vendors.
“To best address this threat, agencies and CI [critical infrastructure] security teams should start with an inventory of what’s connected, who can reach it, and what the mission impact is if it fails. Build that picture with operations, facilities, and your vendors. Then plan for resilience, not just prevention, so you can detect, contain, and recover quickly,” Harmon said in a statement.
The U.S. agencies recommended separating operational technology (OT) devices from business networks, changing default passwords, using phishing-resistant multifactor authentication wherever feasible, and keeping firmware updated.
Operators should also identify and replace unsupported equipment, restrict which devices and network addresses can make changes, and maintain tested backups offline and offsite.
Ireland’s National Cyber Security Centre reinforced the breadth of the exposure in a Nov. 3 advisory: “Organisations should review all remotely accessible refrigeration equipment, regardless of manufacturer.”
That advisory urged operators to inspect temperature settings, defrost schedules, alarm configurations, and remote access permissions for unauthorized changes. It also cautioned that restricting access to known service-provider network addresses should be temporary, not a permanent security solution.
The U.S. fact sheet calls for logging and regular reviews for unexpected activity. Where OT devices lack usable logs, operators should collect network traffic and communications between equipment. It also recommends setting safe operating limits and alerts for deviations, and reporting suspicious activity to CISA or the FBI.