U.S. agencies warn of attacks on grocery and cold-storage cooling systems

Key points

• A joint U.S. advisory published Thursday, Nov. 6, 2026, warns of attacks on cooling-system controllers.
• Adversaries can force warming and defrost phases, creating temperature excursions.
• Supermarkets and chilled warehouses face risks to perishable food and stored medicines.
• No CVE identifiers are associated; defenders must rely on behavioral detection and access controls.

On Thursday, Nov. 6, 2026, federal agencies in the United States released a joint warning about an active campaign against devices that regulate cooling in retail food and cold-chain environments. The notice describes unidentified intruders altering controller operations at supermarkets and temperature-controlled storage sites. Rather than exploiting a named software flaw, the attackers appear to abuse access to these systems to command warming and defrost sequences.

The consequences extend beyond disrupted equipment. Freezer units and chilled rooms protect perishable groceries and pharmaceuticals; unwanted warming or repeated defrost cycles can push temperatures outside safe limits. That creates potential risks for consumer food and for medications requiring strict cold storage. Operators may also face spoilage losses and service interruptions.

The absence of assigned CVE IDs is a key complication. Signature-based scanning will not help defenders find this activity. Instead, teams need visibility into controller commands, setpoint changes, remote access, and network traffic. The advisory reflects concern that many building-automation and refrigeration devices are managed remotely, sometimes with weak authentication or direct internet exposure.

Context matters: grocery chains and cold-storage facilities often depend on vendors or maintenance contractors to manage these controllers, which widens the supply-chain exposure. Treat refrigeration systems as operational technology, not ordinary IT peripherals. Watch for unexpected cycle activations, disabled alarms, configuration edits, or logins outside maintenance windows. Quick validation of temperature alarms and fail-safe behavior is essential while the advisory remains in effect.

What to do now

1. Inventory every refrigeration and defrost controller, then identify internet-facing units and all remote-access paths.
2. Remove direct public exposure and place controllers behind a segmented OT network, VPN, or allowlisted jump host with MFA.
3. Replace default and shared vendor credentials with unique strong passwords, and rotate accounts used by maintenance providers.
4. Centralize logging for setpoint changes, manual cycle overrides, alarm suppression, and remote logins; alert on anomalies.
5. Ask refrigeration vendors for firmware and configuration guidance, apply supported updates, and disable unused services and protocols.
6. Verify temperature alarms and fail-safe behavior; test backup cooling and emergency procedures for food and medicine storage.
7. Report suspicious controller activity to CISA or appropriate authorities and review third-party maintenance access logs.

Original source

Help Net Security