Cold-chain and refrigeration security: what the joint federal advisory asks operators to do

What the agencies published

On November 5, 2026, CISA released a press release about a joint fact sheet from five federal bodies: CISA, the FBI, the Department of Health and Human Services, the U.S. Department of Agriculture and the Department of Transportation. The release says the group published a fact sheet that warns organizations of ongoing cyber threat activity targeting industrial refrigeration and cold chain monitoring systems.

The subtitle of the release frames the purpose of the guidance. It says the recommended mitigations reduce risk to exploitation of vulnerabilities and security weaknesses.

This briefing draws on that press release and on one separate CISA alert dated November 4, 2026. The fact sheet itself was not among the documents reviewed, so everything below is limited to what the press release says the fact sheet contains.

The threat as described

The press release describes activity that is global and aimed at specific kinds of equipment. It says malicious cyber actors are targeting vulnerabilities and weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities.

Two conditions stand out in that wording: devices that are unpatched, and devices that can be reached from the internet. The release names both as the weaknesses being targeted.

What a successful attack could do

The release spells out the consequences. If the actors successfully exploit these devices, they could change the temperature and possibly cause physical impacts such as fire hazards, loss of inventory and changes to the service life of the system.

The FBI's Cyber Branch Operations Director, Brett Leatherman, explains why these systems draw attention. He says industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, which makes them attractive targets.

He adds that the FBI is seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk.

Who is in scope

The release names the sectors that widely use these systems. They are Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems.

That list matches the five agencies on the fact sheet. HHS covers the health sector, USDA covers food and agriculture, and DOT covers transportation. For a hospital pharmacy, a grocery chain or a logistics operator with cold storage, the release places the equipment squarely in the scope of the warning.

The release does not break the threat down by sector or give separate instructions for healthcare, food or logistics. The mitigations below are presented as a single set for any organization that relies on these systems.

The four mitigations

The release lists four protections from the fact sheet. It introduces them as examples, so the fact sheet may contain more detail than the release reproduces.

First, remove control system devices and systems from the internet.

Second, change default passwords and strengthen passwords.

Third, apply patches and keep devices and systems updated.

Fourth, identify, retire, and replace legacy devices that the vendor no longer supports.

Each item maps to a weakness named in the threat description. Internet exposure is addressed by the first item. Default and weak credentials are addressed by the second. Unpatched firmware is addressed by the third. Unsupported hardware, which cannot be patched at all, is addressed by the fourth.

On monitoring, the release itself does not describe logging, alerting or detection steps. It asks for one monitoring-related action: reporting. The FBI urges every organization that relies on these systems to report any suspicious activity to the FBI.

How urgently the agencies frame it

CISA's Acting Executive Assistant Director for Cybersecurity, Chris Butera, says the agency is tracking the activity with partners. In his words, CISA is actively tracking this threat activity.

He sets a broad expectation for who should pay attention. He says every organization that depends on refrigeration and monitoring systems should assume it could be a target.

He also asks for action rather than review alone, saying the agency urges readers to review the joint fact sheet and take action now to close known security gaps.

A separate CISA alert from November 4, 2026

One day before the release, CISA published an unrelated alert on its Known Exploited Vulnerabilities (KEV) Catalog. It says CISA has added one new vulnerability to the catalog, based on evidence of active exploitation.

That entry is CVE-2024-27834, an Apple improper authentication vulnerability. It does not concern refrigeration controllers, and the alert does not link it to the cold-chain activity. It is included here only because it states CISA's general position on vulnerability management.

The alert notes that Binding Operational Directive 26-04 applies only to Federal Civilian Executive Branch agencies. It then says CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.

The alert also tells readers how to contribute. Anyone aware of an exploited vulnerability not listed in the catalog can submit it, and potential additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

What the documents leave open

The press release gives no vulnerability identifiers, product names or vendor names for the refrigeration controllers being targeted. It also gives no attribution to a named threat actor and no count of affected organizations. Readers who need those details will have to consult the full fact sheet, which the release says the agencies published on November 5, 2026.