Cold Chain Cyberattack Warning: CISA and FBI Say Attackers Are Targeting Industrial Refrigeration Controllers, and What to Lock Down This Week

On Thursday, November 5, 2026, CISA, the FBI and three other US federal agencies warned that attackers around the world are targeting the electronic controllers that run commercial refrigeration and cold storage. If your walk-in coolers, freezers or temperature monitoring system can be reached from the internet, or still use a default password, someone could change the settings remotely, spoil your inventory and stop your staff from seeing the real temperature.

The warning is a joint fact sheet. It names no product, vendor or attacker. That means there is no patch notice coming for you to wait on, so any business that depends on temperature-controlled storage should check its own setup now.

What the CISA refrigeration warning says

The fact sheet is titled "US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems." It was published by CISA, the FBI, the Department of Health and Human Services (HHS), the US Department of Agriculture (USDA) and the Department of Transportation (DOT). The agencies say they are "aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally."

The threat section names the targets: electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. The agencies add that these kinds of systems are widely used in the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors, including refrigerated transport. They handle remote temperature monitoring, continuous temperature logging, defrost cycle management and energy optimization.

CISA's announcement quotes Chris Butera, its Acting Executive Assistant Director for Cybersecurity: "Every organization that depends on refrigeration and monitoring systems should assume it could be a target."

What is confirmed and what is not known

Confirmed by the agencies:

• Five federal agencies issued the fact sheet together on November 5, 2026.
• They are aware of malicious activity against refrigeration and cold chain monitoring systems worldwide. CISA's announcement calls it ongoing.
• The targets are controllers that are unpatched or reachable from the internet.
• The fact sheet lists three ways in: authentication bypass, arbitrary code injection and weak configurations.

Not stated in the fact sheet:

• Which controller brands or models are involved. No vendor is named.
• Any CVE numbers or fixed firmware versions.
• Who the attackers are or where they operate from.
• How many sites have been hit. No specific incident is described.

The effects are written as possibilities: attackers "may exploit" weaknesses and "could" change temperatures. Read this as confirmed targeting. The scale of any real damage has not been made public.

How refrigeration controller hacking works

A refrigeration controller is a small computer. It decides when compressors run, when defrost cycles start and what temperature counts as normal. Many have a web panel or remote monitoring feature so a technician can check on them from anywhere.

According to the fact sheet, attackers who get in can change settings remotely and "force units into continuous heating and defrost cycles." The agencies list four possible results of a temperature change: a shorter service life for the equipment, a fire hazard, loss of inventory, and indirect harm to consumers if products are used after unsafe storage.

The second effect is quieter and can be worse. The fact sheet calls it a "denial-of-view" condition, where operators can no longer see current temperatures. If the screen your staff relies on is wrong or blank, a failing cooler may go unnoticed until the product is already lost.

Who should pay attention to this cold storage warning

The fact sheet names retail grocery and cold storage facilities directly. Going by the sectors it lists, we would add any business that relies on networked temperature control or monitoring: food distributors and processors, restaurants with remotely monitored walk-ins, pharmacies, clinics and labs that store vaccines or medicines, and fleets running refrigerated trucks.

Why it matters for a company network

In many businesses, the refrigeration contractor installed the controller, not the IT team. Remote access may have been set up through a port forward on the office router, or through a cloud portal still using the password the device shipped with. IT may not even know it exists.

That causes two problems. First, the controller itself is an easy target. Second, if it shares a flat network with office computers and the point-of-sale system, an attacker who gets into one can reach the other. The agencies give the same advice we give for cameras, door systems and other connected equipment: know what you have, keep it off the open internet and keep it separate from business systems.

Cold storage security checklist for this week

One addition of our own: keep at least one temperature alarm that works independently of the controller. That way, a denial-of-view condition cannot hide a real problem.

Questions to ask your refrigeration contractor

• Which of our controllers can be reached from outside the building, and how?
• Are any still using the default login?
• What firmware is each one running, and is the model still supported?
• Who on your team can log in remotely, and is that access logged?

Cold chain cyberattack questions people are asking

Which refrigeration controllers are affected?

The fact sheet does not name a brand or model. It covers electronic temperature controllers and commercial refrigeration controllers that are unpatched or reachable from the internet.

Is there a patch to install?

No single patch exists. The agencies say to keep firmware current and to replace devices that are at end of life. Check your controller manufacturer's site for its latest firmware.

Who is behind the refrigeration attacks?

The fact sheet does not say. It names no group and no country.

How do I know if my controller is exposed to the internet?

Check your router and firewall for port forwards to the controller. Ask your contractor about any cloud or remote portals, and have an outside scan run against your public IP addresses.

Does this affect refrigerated trucks?

The fact sheet says refrigerated transport services widely use these monitoring systems. The specific targets it describes are controllers in retail grocery and cold storage facilities.

Where do I report suspicious activity?

US organizations can contact CISA at contact@cisa.dhs.gov or 1-844-729-2472, file a report with the FBI's Internet Crime Complaint Center at ic3.gov, or contact a local FBI field office. Healthcare organizations facing supply disruptions can reach HHS at HHSCyber@hhs.gov or 202-619-7800.

The bigger lesson

The equipment that keeps a business running is now a computer on the network, whether or not anyone treats it like one. Coolers, cameras and building systems installed by outside contractors need the same care as your servers: an inventory, strong passwords, regular updates and a separate network.

For help finding and locking down the connected equipment on your network, see security hardening or request a quote.

Get security alerts like this by email, along with our free checklist, at security alerts.

Sources: CISA news release, November 5, 2026; CISA, FBI, HHS, USDA and DOT joint fact sheet.