Grocery chains, cold storage sites and food distributors have spent a month learning that adversaries can manipulate equipment keeping food and medicine cold. Five agencies signed the November 9 notice on these controllers and on cold chain monitoring: CISA, the FBI, HHS, USDA and the Department of Transportation.
The targets sit everywhere. Healthcare providers, chemical makers, transport firms and retailers rely on these controllers to hold set points, log readings, run defrost cycles and trim energy bills. Refrigerated trucks carry the same exposure on the highway, and the activity is global.
How the tampering works
Adversaries reach them by bypassing authentication, injecting arbitrary code, or exploiting weak configurations on internet-reachable hardware. An operator inside can alter settings remotely and push units into continuous heating and defrost cycles, shortening equipment life, creating a fire hazard and destroying inventory in bulk. Spoiled product that ships turns a financial setback into a safety event.
Visibility collapses too. Suppress live readings and staff simply do not know; learning a cold room sat warm for hours is an expensive way to find out.
The fixes are unglamorous. Put panels off the public internet, and where remote management is needed place a current firewall or comparable gateway in front. Put industrial gear on its own virtual network, apart from the office LAN.
Then cover fundamentals: replace default credentials, add phishing-resistant multifactor authentication where feasible, apply firmware updates, retire unsupported hardware, restrict settings changes to approved devices and addresses, keep tested backups offline, and switch on logging. Across the fleet, one safeguard gets overlooked: no controller should drive a freezer past what is safe, whoever submits the command.
Reports go to CISA’s 24/7 operations center or the FBI’s Internet Crime Complaint Center; healthcare groups can also notify HHS. Anyone operating refrigeration should plan on being a target.
