FBI and CISA Warn Hackers Are Targeting Refrigeration and Cold-Chain Controllers: A Checklist for Food Producers, Cold Storage and Industrial Shops

On November 5, 2026, CISA, the FBI, HHS, the U.S. Department of Agriculture and the Department of Transportation published a joint fact sheet warning that malicious cyber actors are targeting industrial refrigeration and cold-chain monitoring systems globally. The agencies say attackers are going after unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities, and can remotely change settings to force units into continuous heating and defrost cycles. If your business runs walk-in coolers, blast freezers, process chillers or refrigerated trucks, and anyone can reach the controller from outside the building, this one is for you.

What the agencies say

The fact sheet, "US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems" (TLP:CLEAR, dated November 5, 2026), says these systems are widely used in the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors, including refrigerated transport, for remote temperature monitoring, continuous temperature logging, defrost cycle management and energy optimization.

The agencies list three ways in: authentication bypass, arbitrary code injection and weak configurations. Once in, an attacker could change temperatures, which the fact sheet says could shorten the service life of the system, create a fire hazard, cause loss of inventory, or indirectly harm consumers if products are eaten after unsafe storage. Attackers could also cause a loss of visibility into current temperatures, a "denial-of-view" condition where your screen stops telling you the truth.

"Every organization that depends on refrigeration and monitoring systems should assume it could be a target," CISA Acting Executive Assistant Director for Cybersecurity Chris Butera said in the CISA announcement. FBI Cyber Branch Operations Director Brett Leatherman said the FBI is "seeing these systems targeted across critical infrastructure sectors globally."

The warning follows attacks in Europe. BleepingComputer reported that refrigeration controllers at an estimated 250 to 350 French supermarkets were compromised in October, with defrost functions switched on remotely, and that a second wave in November affected more than 115 stores across six European countries.

What we are not claiming: The U.S. fact sheet does not name a threat actor, a controller brand, a specific vulnerability (CVE) or any U.S. victim, and it does not say how many U.S. systems have been hit. The European store counts come from press reporting, not from the U.S. agencies. We are not saying any particular controller or any particular business has been compromised. We are saying the agencies describe the activity as ongoing, and that a controller reachable from the internet with a default password is exactly what they are warning about.

Why small food, production and industrial shops should care

This isn't only a supermarket problem. Food processors, meat and dairy plants, bakeries, breweries and beverage makers, produce packers, cold storage and 3PL warehouses, refrigerated carriers, florists, and manufacturers with process cooling or chilled-water loops all depend on the same kind of controllers. In smaller operations, the refrigeration contractor often installed a cellular modem or opened a port so they could check alarms from a phone, and nobody on the IT side ever saw it. That remote convenience is the exposure. A warm walk-in over a weekend can mean a full inventory write-off, a food safety call to your customers and an insurance claim, before anyone thinks "cyberattack."

What to do this week

1. List every controller and monitoring box. Walk the building with your refrigeration or HVAC contractor. Record make, model, firmware version, where it sits on the network, and who has the login. Include temperature loggers, rack controllers, case controllers, chiller panels, and any monitoring gateway or cellular modem the contractor added.
2. Find out what's reachable from the internet. Ask your contractor and your IT provider, in writing, whether any controller, web panel or monitoring portal can be reached from outside your network. Check firewall port forwards and any "remote access" boxes. The fact sheet's first recommendation is simple: do not expose control system devices, especially controller panels, to the internet.
3. If remote access is needed, put it behind a gate. Route it through a firewall or VPN that is patched to its latest version, limit it to known devices and IP addresses, and turn it off for vendors when they aren't actively working.
4. Change default passwords today. Every controller, gateway and monitoring account. Use unique, strong passwords and store them in a password manager, not on a label inside the panel door. Turn on phishing-resistant MFA wherever the portal supports it.
5. Separate the refrigeration network. Put controllers on their own VLAN, apart from office PCs, guest Wi-Fi and point-of-sale systems, as the fact sheet recommends.
6. Patch and plan replacements. Ask the manufacturer or contractor for current firmware. Flag any controller that is end of life and no longer supported, and budget to replace it.
7. Set setpoint limits and independent alarms. Configure reasonable minimum and maximum setpoints, and alert on any deviation. Keep at least one independent temperature alarm (a standalone logger or probe with its own alerting) so a "denial-of-view" on the main screen doesn't hide a warm box.
8. Back up configurations and turn on logging. Save a current, offline copy of each controller's settings and test that you can restore it. Enable logs where available and review them for changes nobody on your team made.
9. Know who to call. Report suspicious activity to CISA (1-844-Say-CISA or contact@cisa.dhs.gov) or the FBI's IC3, and notify your insurer per your policy.

The takeaway for IT decision-makers

Your coolers are now part of your attack surface. Five U.S. agencies are warning that attackers are hunting for refrigeration and cold-chain controllers they can reach from the internet, and the fixes are basic: get controllers off the open internet, change default passwords, separate the network, patch, and keep an independent temperature alarm. None of that requires new equipment. It requires someone to own the list. If you want help finding every controller and remote-access path in your plant or warehouse, Brotherly Technology can walk it with your refrigeration contractor.

Sources

• CISA: CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity (Nov 5, 2026)
• CISA/FBI/HHS/USDA/DOT fact sheet: US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems (TLP:CLEAR, Nov 5, 2026)
• BleepingComputer: FBI, CISA warn of cyberattacks targeting refrigeration systems (Nov 5, 2026)