The FBI and CISA, joined by HHS, USDA and DOT, warn that attackers worldwide are breaking into internet-reachable refrigeration controllers and forcing them into heating and defrost. These refrigeration controller cyberattacks have already hit hundreds of European supermarkets and three French blood-storage sites, so Cyprus firms with connected cooling should check where their controllers are exposed.
Key takeaways
- Five U.S. agencies warn that internet-exposed refrigeration controllers are being attacked worldwide, with no CVE, vendor or actor named.
- Attackers use authentication bypass, code injection and weak configurations to force heating or defrost and hide real temperatures.
- An estimated 250 to 350 French supermarkets were hit in October, 115+ stores in six countries in November, plus three EFS blood-storage sites.
- Removing controllers from the internet, ending shared vendor logins and enforcing temperature limits matter most.
What did the FBI and CISA warn about refrigeration controllers?
The joint advisory, issued by the FBI and CISA with the Departments of Health and Human Services, Agriculture and Transportation, says attackers are targeting electronic temperature controllers and commercial refrigeration management systems that are unpatched or reachable from the internet. Its reach extends beyond grocery retail and cold storage to healthcare, food production, chemical facilities and transportation.
“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s Acting Executive Assistant Director for Cybersecurity.
The advisory names no vendor, model, firmware version, CVE, malware or threat actor. Our reading: this is a campaign built on exposure, not a single bug you can patch and forget.
How do attackers change freezer temperatures remotely?
The agencies name three ways in: authentication bypass flaws, arbitrary code injection flaws and weak configurations, which in practice often means unchanged vendor-default credentials. After that, no special tooling is needed. Attackers use the controller’s own functions to change setpoints and force units into continuous heating or defrost.
Worth knowing: a normal defrost warms the evaporator briefly to clear ice. Left running, it heats the cabinet’s contents instead.
The advisory lists inventory loss, shorter equipment life, fire hazards and unsafe storage conditions. Attackers may also degrade visibility, so staff see a normal dashboard while stock spoils.
What happened in Europe, including at blood storage sites?
In October, attackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets, remotely triggering defrost and raising temperatures. A second wave in November affected more than 115 stores across six European countries. Some systems shut down entirely; others were driven as high as 50°C (122°F).
On 3 November the French Blood Establishment (EFS) confirmed that a cybersecurity incident at a refrigeration equipment provider had altered temperature and defrost settings at three facilities storing blood products. The provider is not named, and nothing in the reporting ties it to the retail waves.
Why do refrigeration controller cyberattacks matter for Cyprus?
Cyprus supermarkets, cold stores, hospitals, pharmaceutical warehouses and logistics hubs run the same classes of controllers, and nothing in the advisory limits the threat to France or the U.S. A Nicosia pharmaceutical wholesaler fits the target profile as well as a Limassol hypermarket.
NIS2 can bring food distribution, healthcare and transport operators into scope as essential or important entities. An in-scope entity must send CSIRT-CY, under the Digital Security Authority (DSA), an early warning within 24 hours of becoming aware of a significant incident and a fuller notification within 72 hours. A tampered cold room may be a reportable incident, not only an insurance claim.
The EFS incident started at a supplier. In our experience, refrigeration contractors often hold standing remote access across a client’s estate, sometimes through one shared account. Ports, reefer depots and fleet operators should question their monitoring vendors too; we test that access layer in our maritime and shipping penetration testing.
What should operators do about refrigeration controller cyberattacks?
The agencies’ mitigations, in the order we would tackle them:
- Remove exposure. Our suggestion: search your IP ranges in Shodan or Censys for exposed BACnet and Modbus services and vendor web portals.
- Secure remaining remote access with a VPN or broker, MFA and named accounts, never a port-forward.
- Change default passwords and end shared vendor logins.
- Isolate OT from business networks and apply available updates.
- Enforce safe temperature limits and keep an independent alarm.
In our experience, controllers stay in service for years, often with no practical update path, so exposure removal and setpoint limits matter more than patching.
From our engagements: in OT and ICS assessments, controllers an installer port-forwarded years earlier are a common finding, and an external network penetration test is the fastest way to surface them.
If you suspect tampering, preserve controller logs and the historian before resetting setpoints, and check whether alarm thresholds changed.
What is still unknown?
Attribution, affected products and motive remain open, including whether the October and November waves share an operator. Until CISA publishes indicators, treat the exposed controller itself as the vulnerability.
FAQ
Are refrigeration systems being hacked?
Yes. Five U.S. agencies confirm active attacks, and European supermarkets saw two waves in October and November.
How can hackers change freezer temperatures remotely?
They reach an exposed management interface, get past the login through a flaw or default password, then raise setpoints or keep defrost running.
Does the advisory name a CVE, vendor or threat group?
No. It names no CVE, product, firmware, malware or actor, which points to a campaign exploiting exposure.
Are cold storage and food retailers covered by NIS2?
Food distribution, healthcare and transport operators can be essential or important entities. If so, significant incidents go to CSIRT-CY within 24 hours (early warning) and 72 hours (notification).
If your cold rooms, pharmacy fridges or reefer monitoring sit inside NIS2 scope, our NIS2 penetration testing can map which controllers and vendor accounts an attacker could reach.