Five Federal Agencies Tell Cold Chain Operators to Take Controllers Off the Internet
The joint fact sheet lists three exploitation routes and eight mitigations, and covers four critical infrastructure sectors including refrigerated transport. Seven of the eight mitigations map to numbered federal performance goals. The eighth does not.
Five federal agencies signed a fact sheet on Nov. 5 telling the operators of industrial refrigeration and cold chain monitoring systems to take controller panels off the public internet. Malicious actors "may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards," the document said. The Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation are listed as the authoring organizations.
Four Sectors and Refrigerated Transport
The fact sheet reaches past the retail grocery cases that drew attention in Europe last month. It names organizations in the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors as widespread users of these systems, and calls out refrigerated transport services. The functions it lists are automated and remote temperature monitoring, continuous temperature logging, defrost cycle management and energy optimization. The targets, it said, are electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities.
Three Routes In, and What Goes Wrong
The exploitation routes the agencies list are authentication bypass, arbitrary code injection and weak configurations. The effects they describe run wider than spoiled stock. A temperature change can shorten the service life of the system, create a fire hazard, or indirectly harm consumers who eat product stored unsafely. The agencies also flag a denial-of-view condition, in which an operator keeps the equipment but loses sight of what temperature it is holding.
Seven of the eight mitigations carry numbered Cross-Sector Cybersecurity Performance Goals that CISA developed with the National Institute of Standards and Technology. "Do not expose control system devices and/or systems, particularly controller panels, to the internet," reads the first, tagged CPG 3.S, which allows a firewall or an updated edge device where remote access is necessary. The rest ask for a dedicated operational technology VLAN separating those devices from business networks. Beyond that the agencies list changed default passwords and phishing-resistant multifactor authentication where feasible, firmware updates alongside a lifecycle process to "identify, retire, and replace legacy devices that are at end of life," device and IP address allowlisting, backups held offsite and offline and tested, and logging, with network traffic capture where controller logs are non-standard or unavailable.
On the patching item the agencies point private operators at two binding operational directives CISA wrote for federal civilian agencies, BOD 26-04 on prioritizing security updates by risk and BOD 26-02 on end-of-support edge devices. The fact sheet names no vendor, product or protocol, and closes with a disclaimer that any reference to a commercial product does not imply endorsement. Reporting goes to CISA's operations center or the FBI's Internet Crime Complaint Center, and healthcare operators get a separate HHS line at 202-619-7800 for supply chain disruption.
Why This Matters to Contractors
The eighth mitigation is the only one with no performance goal number behind it: "Define and maintain reasonable setpoint limits for devices operating downstream of controllers to stay within safe ranges and establish alerting for deviations." That is a commissioning task, not an IT task, and on a grocery or cold storage job the people who can perform it are the refrigeration service contractor and the controls integrator. It also sets a limit that holds even after a controller is compromised, which none of the other seven items do once an attacker is already authenticated.
Sources
- CISA, FBI, HHS, USDA and DoT, "US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems," fact sheet, Nov. 5, 2026. cisa.gov
- Joint fact sheet, TLP:CLEAR PDF, as of Nov. 5, 2026. cisa.gov
- CISA, "Cross-Sector Cybersecurity Performance Goals." cisa.gov
- CISA, "BOD 26-02: Mitigating Risk From End-of-Support Edge Devices." cisa.gov
- CISA, "BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk." cisa.gov