US Agencies Urge Hardening of Industrial Refrigeration and Cold Chain Systems

Five U.S. federal agencies published a joint fact sheet on 5 November 2026 urging owners to harden industrial refrigeration and cold chain monitoring systems. The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), the U.S. Department of Agriculture (USDA) and the Department of Transportation (DoT) say they are aware of malicious cyber activity targeting these systems globally.

The Red Tiger team covered the European supermarket wave, the UK food supply chain update and the French blood bank incident earlier this month. We are flagging this fact sheet because it is the first multi-agency U.S. guidance on this active campaign, and because it names the critical infrastructure sectors that use these controllers every day.

Who uses these systems

The authoring organizations say Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems (including refrigerated transport) widely use industrial refrigeration and cold chain monitoring for automated and remote temperature monitoring, continuous temperature logging, defrost cycle management and energy optimization. Actors are targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities.

How the attacks work

Vectors called out in the fact sheet are authentication bypass, arbitrary code injection and weak configurations on unpatched or internet-accessible controllers. If an attack succeeds, temperature changes can shorten equipment life, create a fire hazard, destroy inventory and indirectly harm consumers if products are later used after unsafe storage. Attackers can also cause a denial-of-view condition, meaning operators lose visibility into current temperatures. The joint fact sheet does not name vendors, does not list a Common Vulnerabilities and Exposures (CVE) identifier and does not attribute the activity to a country or group.

What this means for OT owners

These controllers sit in cold rooms, freezers, chillers and refrigerated transport across chemical plants, food and beverage sites, pharmaceutical storage, healthcare cold chain and port and trucking cold yards. They are often installed and supported by a refrigeration contractor, reached from outside over a public address or cellular modem, and left out of the operational technology (OT) asset inventory. The same class of exposure drove the European, UK and French healthcare waves we have already reported.

What to do now

The fact sheet aligns its steps with the Cross-Sector Cybersecurity Performance Goals (CPGs) from CISA and the National Institute of Standards and Technology (NIST). In plant language:

1. Take controller panels off the public internet (CPG 3.S). If remote access is still needed, put it behind a firewall or edge device that is kept updated.
2. Put OT devices on a dedicated virtual local area network (VLAN) so they are separate from the business network (CPG 3.I).
3. Change default passwords, strengthen passwords and use phishing-resistant multi-factor authentication (MFA) where it is feasible (CPG 3.A, 3.B, 3.F). Apply patches, and plan a lifecycle for end-of-life (EOL) unsupported devices (CPG 2.A, 2.B).
4. Allowlist the devices and internet protocol (IP) addresses that may change setpoints (CPG 3.H), keep offsite and offline backups that you have tested (CPG 3.O), enable and review logging or collect network traffic where OT has no logs (CPG 3.Q), and review setpoint ranges with alerts on deviations.

Report suspicious activity to CISA's 24/7 Operations Center, to the FBI Internet Crime Complaint Center (IC3) or your local FBI field office, and for healthcare supply-chain impacts to HHSCyber.

Prior Red Tiger advisories on this campaign: https://www.redtigersecurity.com/advisory/certfr-refrigeration-controllers-campaign ; https://www.redtigersecurity.com/advisory/european-supermarket-refrigeration-attacks ; https://www.redtigersecurity.com/advisory/uk-food-supply-refrigeration-attacks ; https://www.redtigersecurity.com/advisory/french-blood-bank-refrigeration-attack

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: CISA, FBI, HHS, USDA and DoT joint fact sheet (5 November 2026, TLP:CLEAR) https://www.ic3.gov/CSA/2026/261105.pdf ; Red Tiger prior advisories linked above. Press coverage of the fact sheet (TechCrunch, 5 November 2026) is secondary context only and is not used for attribution.