US Government Agencies Issue Joint Advisory on Industrial Refrigeration Cyber Threats

The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Health and Human Services (HHS), U.S. Department of Agriculture (USDA), and the Department of Transportation (DoT) have issued a joint advisory warning of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems. These systems, widely used across the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors, automate and remotely monitor temperatures, log continuous temperature data, manage defrost cycles, and optimize energy use.

The advisory identifies that threat actors are targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. Actors may exploit authentication bypass, arbitrary code injection, and weak configurations in unpatched or internet-accessible devices to remotely alter settings and force units into continuous heating and defrost cycles. Such exploitation can affect the service life of the system, create fire hazards, cause loss of inventory, and indirectly harm consumers if products are consumed after unsafe storage. Additionally, actors can cause a denial-of-view condition by disabling visibility into current temperatures.

The authoring organizations urge owners and operators to defend against this activity by eliminating public internet exposure for controller panels, isolating operational technology (OT) devices on dedicated VLANs, enforcing credential security through changed default passwords and phishing-resistant multifactor authentication, keeping device firmware up to date, restricting access via IP allowlisting, maintaining offline backups, enabling logging for anomaly detection, and reviewing setpoint ranges to establish safe operating limits and alerting for deviations.

The mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The agencies also direct organizations to CISA guidance on Internet Exposure Reduction, Defend the Edge: The Critical Importance of Edge Device Security, and BOD 26-04 and BOD 26-02 for prioritizing security updates and mitigating risk from end-of-support edge devices.