[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-us-agencies-warn-of-attacks-on-refrigeration-controllers":10,"sections":50},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":39,"tags":40,"sources":45,"feedback":49,"feedback_at":22,"cost_usd":49,"total_tokens":49},12411,"us-agencies-warn-of-attacks-on-refrigeration-controllers","US Agencies Warn of Attacks on Refrigeration Controllers","Five federal agencies say attackers can push cold storage controllers into constant heating, and their fix list leans heavily on basic network hygiene.","Five US federal agencies say attackers are targeting the temperature controllers inside grocery stores and cold storage facilities, and they want owners to take those controllers off the public internet.\n\nThe joint advisory comes from the FBI, the Department of Health and Human Services, the Department of Agriculture, the Department of Transportation and the federal cybersecurity agency. The agencies describe malicious activity against industrial refrigeration and cold chain monitoring systems globally. These systems handle remote temperature monitoring, continuous logging, defrost cycle management and energy optimization, including in refrigerated transport. Healthcare, chemical, food and agriculture, and transportation organizations all use them.\n\nThe described attack is simple in outline. Actors exploit unpatched or internet-accessible controllers to change settings remotely and force units into continuous heating and defrost cycles. The agencies list three routes in: authentication bypass, arbitrary code injection (running commands the attacker supplies) and weak configurations. The consequences range from shortened equipment life and a fire hazard to lost inventory and, indirectly, harm to consumers who eat food that was stored unsafely. Attackers could also cut off operators' view of current temperatures, which the advisory calls a denial-of-view condition.\n\nThe damage here is physical spoilage, not stolen data, which makes it a different kind of problem from the usual breach. The advisory also says the actors \"may\" exploit these flaws, and it names no specific actors, victims or vulnerabilities, so the scale of the activity is hard to judge from the text alone.\n\nMost of the mitigations are baseline practice: no internet exposure for controller panels, a dedicated OT network (a separate VLAN) walled off from business systems, changed default passwords, phishing-resistant multifactor authentication, IP allowlists, offline backups and logging. The one item tailored to refrigeration is setting reasonable limits on the temperatures that downstream devices will accept, with alerts on deviations. The logic is that a compromised controller still cannot quietly push equipment outside a safe range.\n\nThe costly item sits in the middle of that list. Owners are also told to retire and replace end-of-life devices that the manufacturer no longer supports, and for a store chain running older controllers that is a purchasing decision, not a settings change. The advisory does not say how many such controllers are still in service.","[\"industrial-control-systems\",\"cold-chain\",\"ot-security\",\"critical-infrastructure\"]","2026-11-05T12:00:00.000Z","2026-11-08T00:52:02.664Z","2026-11-08T00:52:02.907Z","published",null,[24,30,35],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove or source the 'November 5' date, which does not appear anywhere in the source material; drop the unsupported claim that setpoint limits are 'the only step that still helps if every other defense fails' (offline backups and alerting also help); and fix the closing line, which wrongly says HHS is offering help 'for that reason' when the source presents that as a generic contact line for health supply-chain disruptions.","resolved",{"id":31,"reviewer":32,"round":33,"reason":34,"status":29},"publisher-r2","publisher",2,"The sixth paragraph refers to 'the setpoint item' on the mitigation list, but the mitigations paragraph never mentions setting safe limits or setpoints, so a list item appears to have been dropped and the article is internally inconsistent.",{"id":36,"reviewer":26,"round":37,"reason":38,"status":29},"editor-r3",3,"The setpoint item now appears in the mitigations list, but the closing paragraph refers to 'the five signatures', which the source never mentions (it names five authoring agencies, not signatories), and its claim that no single regulator owns these controllers has no support in the source. The 'November 5' publication date also appears nowhere in the source material. Fix the closing line, cut or source the regulator-gap claim, and drop or verify the date.","security",[41,42,43,44],"industrial-control-systems","cold-chain","ot-security","critical-infrastructure",[46],{"name":47,"url":48},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fresources\u002Fus-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems",0,{"sections":51},[52,57,61,66,71,76,81,86,91,96,101,106,111,116],{"name":53,"slug":54,"count":55,"latest_published_at":56},"AI","ai",7110,"2026-11-08T14:34:09.000Z",{"name":58,"slug":39,"count":59,"latest_published_at":60},"Security",1099,"2026-11-08T15:24:01.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Deals","deals",620,"2026-11-08T08:00:00.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Policy","policy",604,"2026-11-07T15:48:26.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Consumer Tech","consumer-tech",336,"2026-11-08T21:00:00.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Hardware","hardware",316,"2026-11-08T14:36:39.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Science","science",222,"2026-11-07T16:19:17.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Software","software",154,"2026-11-08T15:42:52.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Startups","startups",150,"2026-11-06T16:50:01.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Dev Tools","dev-tools",125,"2026-11-06T22:15:59.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"General","general",111,"2026-11-08T21:27:29.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"Gaming","gaming",94,"2026-11-08T20:52:05.000Z",{"name":112,"slug":113,"count":114,"latest_published_at":115},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":117,"slug":118,"count":119,"latest_published_at":120},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]