Hackers are targeting commercial refrigeration systems and can force them into heating or defrost cycles, putting food supplies and costly inventory at risk, federal agencies warned today.

The warning concerns internet-connected controls used by grocery stores, cold-storage facilities and other businesses.

The FBI, CISA and the federal departments of Health and Human Services, Agriculture and Transportation said attackers are targeting electronic temperature controllers and commercial refrigeration controls around the world.

By taking advantage of outdated software or poorly secured internet connections, hackers may be able to change temperature settings or prevent operators from seeing the actual temperatures inside their equipment.

That could spoil inventory, damage equipment, create fire hazards or put consumers at risk if products are used after being stored at unsafe temperatures, the agencies said.

Businesses that rely on refrigerated food, medicine or other temperature-sensitive supplies are being urged to check their systems. The agencies recommend:

• Removing refrigeration controls from the public internet and turning off remote access that is not needed.
• Securing any necessary remote access and keeping the equipment’s software up to date.
• Changing default passwords, using strong passwords and adding multifactor authentication where possible.
• Keeping refrigeration controls separate from business computer networks.
• Watching for unusual activity and setting alerts when temperatures move outside safe ranges.
• Replacing equipment that no longer receives security updates.