FBI and CISA Warn of Cyberattacks Targeting Refrigeration Systems

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have warned that malicious actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally. Issued alongside the U.S. Departments of Health and Human Services, Agriculture, and Transportation, the joint advisory warns that exploiting unpatched or internet-exposed controllers risks food spoilage, equipment destruction, and fire hazards across healthcare, agriculture, and chemical sectors. Facilities in Malaysia maintaining critical cold-chain infrastructure should verify device exposure, and report any detected cyber incidents to Cyber999 (MyCERT).

Key Facts

Are Refrigeration Controllers Actively Being Targeted in the Wild?

Yes, malicious actors are actively compromising refrigeration systems globally. Attacks have already struck European facilities, including between 250 and 350 French supermarkets in October, over 115 stores across six European nations in November, and three blood storage facilities operated by the French Blood Establishment (EFS).

During the European incidents, attackers remotely manipulated controller functions, triggering defrost cycles and forcing temperatures up to 50°C (122°F), whilst other units were shut down completely. The French Blood Establishment confirmed that an incident involving a refrigeration equipment provider altered temperature and defrost parameters at three storage centres. Chris Butera, CISA Acting Executive Assistant Director for Cybersecurity, stated that any organisation reliant on refrigeration and monitoring systems should assume it could be targeted.

Attackers in Europe raised temperatures in compromised supermarket refrigeration systems to as high as 50°C.

How Do Attackers Compromise and Manipulate These Systems?

Attackers exploit authentication bypass vulnerabilities, arbitrary code injection flaws, or weak configurations on unpatched, internet-accessible controllers. Once inside, they alter temperature parameters, force equipment into continuous heating or defrost cycles, or blind monitoring tools, preventing operators from spotting anomalous temperature shifts.

Electronic temperature controllers and refrigeration management systems allow personnel to manage cooling equipment, run defrost routines, and monitor readings remotely. When threat actors subvert these controls, they can cause inventory destruction, shorten hardware lifespan, and create fire hazards. By diminishing operator visibility into real-time temperatures, threat actors prevent facility staff from rapidly detecting and mitigating dangerous thermal deviations.

Intruders can exploit weak configurations and code injection flaws to obscure temperature readings and trigger continuous defrost cycles.

What Should You Do?

• Disconnect from public internet: Remove commercial refrigeration controllers and temperature monitoring units from direct internet exposure.
• Apply available vendor updates: Specific patch versions were not detailed in the advisory, but operators should apply all available security updates from equipment vendors immediately.
• Secure remote access: Restrict and enforce strong authentication controls on all necessary remote management pathways.
• Change default credentials: Replace default administrative and device passwords with robust, unique alternatives.
• Isolate operational networks: Segment operational technology systems away from general corporate business networks.
• Enforce temperature safeguards: Establish safe operational temperature limits within controller settings to prevent devices from running outside acceptable bounds.

Common Questions

Which industries are affected by this advisory?

The advisory applies to critical infrastructure operators utilising refrigeration controllers across healthcare, food production, retail grocery, chemical facilities, cold storage, and transportation. Any organisation relying on remote electronic temperature monitoring and cooling management equipment faces operational disruption risks from these attacks.

What physical risks arise from these cyberattacks?

Beyond spoiled food and compromised medical inventory, manipulating refrigeration controllers into continuous heating or defrost cycles can trigger equipment damage, reduce machinery lifespan, and create fire hazards. Suppressed telemetry may also prevent staff from noticing unsafe storage temperatures before catastrophic failure occurs.

Were medical facilities disrupted during recent incidents?

Yes. On November 3, the French Blood Establishment (EFS) confirmed that a cybersecurity incident involving a refrigeration equipment provider altered temperature and defrost configurations across three blood product storage facilities, demonstrating that cold-chain healthcare infrastructure is actively being impacted.

Sources and Methodology

This dispatch is based solely on reporting published by BleepingComputer on November 5, 2026. ROCKSTARmedia Infosec has not independently reviewed, verified, or inspected external advisories, regulatory filings, or vendor notices beyond the provided source material.