The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Health and Human Services (HHS), U.S. Department of Agriculture (USDA), and Department of Transportation (DoT) have released a joint fact sheet warning of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally.
These systems are extensively used in the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors. They support critical functions including refrigerated transport services, automated and remote temperature monitoring, continuous temperature logging, defrost cycle management, and energy optimization.
Threat Details
Threat actors are specifically targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. They exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles.
Exploitation vectors include authentication bypass, arbitrary code injection, and weak configurations. Potential impacts encompass changes in temperature that affect system service life, create fire hazards, cause widespread inventory loss, and indirectly harm consumers through unsafe product storage. Attackers can also induce a denial-of-view condition by removing visibility into current temperatures.
Recommended Mitigations
The authoring organizations urge immediate action aligned with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and NIST:
- Eliminate public internet exposure of control system devices and controller panels.
- Isolate operational technology (OT) devices using dedicated OT VLANs.
- Enforce credential security by changing default passwords, strengthening policies, and implementing phishing-resistant multifactor authentication.
- Apply patches and establish lifecycle management for legacy devices at end of life.
- Restrict access through device and IP address allowlisting.
- Maintain current offline and offsite backups and test them regularly.
- Enable logging, review for anomalies, and define reasonable setpoint limits with deviation alerting.
Additional guidance references include CISA’s Internet Exposure Reduction Guidance, BOD 26-04, and BOD 26-02.
