According to the warning, attackers exploit authentication bypass flaws, code injection or weak configurations to change temperatures and force cooling equipment into continuous heating or defrost cycles. The result can be spoiled inventory, equipment damage, fire hazards and unsafe storage conditions, sometimes with the real temperature hidden from operators. "Every organization that depends on refrigeration and monitoring systems should assume it could be a target," said CISA's Chris Butera.
The warning follows a series of attacks in Europe. In October, refrigeration controllers at an estimated 250 to 350 French supermarkets were compromised, and a second wave in November hit more than 115 stores in six countries, some reaching temperatures of up to 50°C. On November 3, the French blood service EFS confirmed that altered settings at a refrigeration supplier affected three facilities storing blood products.
What to do: remove refrigeration controllers from the public internet, secure any necessary remote access, change default passwords and apply security updates. The agencies also recommend isolating operational technology from business networks and enforcing safe temperature limits the controller cannot exceed.