Five US federal agencies say attackers are targeting the temperature controllers inside grocery stores and cold storage facilities, and they want owners to take those controllers off the public internet.
The joint advisory comes from the FBI, the Department of Health and Human Services, the Department of Agriculture, the Department of Transportation and the federal cybersecurity agency. The agencies describe malicious activity against industrial refrigeration and cold chain monitoring systems globally. These systems handle remote temperature monitoring, continuous logging, defrost cycle management and energy optimization, including in refrigerated transport. Healthcare, chemical, food and agriculture, and transportation organizations all use them.
The described attack is simple in outline. Actors exploit unpatched or internet-accessible controllers to change settings remotely and force units into continuous heating and defrost cycles. The agencies list three routes in: authentication bypass, arbitrary code injection (running commands the attacker supplies) and weak configurations. The consequences range from shortened equipment life and a fire hazard to lost inventory and, indirectly, harm to consumers who eat food that was stored unsafely. Attackers could also cut off operators' view of current temperatures, which the advisory calls a denial-of-view condition.
The damage here is physical spoilage, not stolen data, which makes it a different kind of problem from the usual breach. The advisory also says the actors "may" exploit these flaws, and it names no specific actors, victims or vulnerabilities, so the scale of the activity is hard to judge from the text alone.
Most of the mitigations are baseline practice: no internet exposure for controller panels, a dedicated OT network (a separate VLAN) walled off from business systems, changed default passwords, phishing-resistant multifactor authentication, IP allowlists, offline backups and logging. The one item tailored to refrigeration is setting reasonable limits on the temperatures that downstream devices will accept, with alerts on deviations. The logic is that a compromised controller still cannot quietly push equipment outside a safe range.
The costly item sits in the middle of that list. Owners are also told to retire and replace end-of-life devices that the manufacturer no longer supports, and for a store chain running older controllers that is a purchasing decision, not a settings change. The advisory does not say how many such controllers are still in service.