If your walk-in cooler or freezer has a controller you can check from your phone, read this.
The FBI and the US government's cyber agency (CISA) put out a warning Thursday about criminals breaking into those controllers. Once they're in, they can turn up the heat or force units into nonstop defrost. Supermarkets in Europe have already lost stock this way.
What happened
On November 5, 2026, CISA and the FBI, along with three other US federal departments (health, agriculture and transportation), published a joint advisory about attacks on refrigeration and cold storage controls. These are the electronic temperature controllers and refrigeration management systems used in grocery stores, cold storage warehouses and refrigerated transport.
According to the advisory, attackers go after controllers that are reachable from the internet, haven't been updated, or are still set up with weak or default passwords. Once in, they can change temperature settings and push equipment into continuous heating or defrost cycles. They can also hide what the real temperature is, so staff don't notice until the product is already spoiled.
BleepingComputer reports this isn't theoretical. In October, attackers got into refrigeration controllers at hundreds of French supermarkets and raised fridge and freezer temperatures. A second wave in November hit more than 115 stores across six European countries.
What this means in plain English
Think of the controller as the thermostat for your walk-in, except it has its own little website so your refrigeration contractor (or you) can check it remotely. If that website is open to the whole internet and the password is still the one printed in the manual, anyone who finds it can walk in and change the settings.
What can they actually do? Warm up your cooler. Run the defrost cycle until everything thaws. Make the screen show a normal temperature while it isn't. The advisory also mentions shorter equipment life and even fire hazards.
Why a small business should care
You don't need to be a grocery chain for this to hurt. A restaurant, butcher, bakery, food processor or pharmacy can lose a full walk-in of stock overnight. Worse, if nobody notices, spoiled product could get sold or served.
The other problem is ownership. These controllers usually get installed by the refrigeration contractor, not your IT person. So nobody is updating them, changing the password or checking whether they're open to the internet.
Who's affected
Electronic temperature controllers and commercial refrigeration controllers that can be reached over the internet
Controllers that haven't had firmware updates (firmware is the built-in software that runs the device)
Anything still using the factory default password
The advisory doesn't name one brand. It covers this whole category of equipment.
What to do: everyone
Find out if your coolers or freezers have a controller you can check from a phone app or a web page.
If they do, write down who installed it and who has the login.
Look at the temperature with your own eyes (a plain thermometer inside the unit) once a day, not just on the app.
If a reading or a setting looks wrong, call your refrigeration contractor and your IT provider the same day.
What to do: if you run the business
Ask your refrigeration contractor, in writing, whether the controller is reachable from the internet. If it is, ask them to take it off or put it behind a properly secured remote connection.
Get the default password changed and keep the new one somewhere safe.
Ask for any available updates to be installed.
Ask your IT provider to keep the cooler controls on their own separate part of your network, away from your office computers.
Have limits set on the controller so nobody can push temperatures outside a safe range.
Questions to ask your IT provider
Can you check whether any of our equipment, including the cooler controls, can be reached from the internet?
Are our refrigeration controls on a separate network from our office computers?
Will we get an alert if a temperature setting changes or the unit goes offline?
Sources
BleepingComputer: FBI, CISA warn of cyberattacks targeting refrigeration systems
FBI IC3 / CISA: US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems
Contact Nautalex to see how we can help you with securing your cooler and freezer controls.
