US Agencies Warn That Hackers Are Targeting the Temperature Controls on Freezers
Five US federal agencies said on Nov. 5, 2026, that they are aware of malicious cyber activity targeting the industrial refrigeration and cold chain monitoring systems that keep food and medicine cold. CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation issued the warning jointly and described the activity as global.
The agencies say these systems are in wide use in healthcare, food and agriculture, chemical and transportation operations, including refrigerated transport, for remote temperature monitoring, continuous logging and defrost control. What they ask of owners and operators is ordinary maintenance: use strong authentication, keep systems updated, find any device reachable from the internet, and drop remote access that is not needed.
What the agencies say they have observed is targeting rather than damage: actors going after electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. Their joint fact sheet reports no incident count, names no victim and names no attacker. Everything past the targeting is written as a possibility. The agencies say actors may exploit unpatched or internet-accessible controllers to change settings remotely and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.
The listed effects of a successful break-in begin with a change of temperature, which the agencies say could shorten a unit's service life, create a fire hazard, cause loss of inventory, or indirectly harm consumers if products are eaten after unsafe storage. The other listed effect is losing sight of the readings altogether, which the fact sheet calls "a denial-of-view condition." The weaknesses are given only by category: authentication bypass, arbitrary code injection and weak configurations.
The fact sheet urges operators to take eight actions immediately. It puts keeping controller panels off the public internet first, then separating operational technology onto its own network and changing default passwords. The rest cover firmware patching, retiring unsupported devices, address allowlisting, tested offline backups, log review, and safe limits on how far a temperature setpoint can be moved.
