Refrigeration System Attacks Are a Wake-Up Call for UK IoT and OT Security

A coordinated wave of cyberattacks targeting internet-connected refrigeration and cold-chain monitoring systems has prompted a joint advisory from CISA and the FBI, warning that threat actors are actively exploiting vulnerabilities in unpatched or internet-accessible industrial controllers to remotely manipulate temperature settings. Wired reports that the attacks have affected blood laboratories and grocery stores, with units being forced into continuous heating cycles — creating risks of spoiled inventory, fire hazards, and significant operational disruption. Palo Alto Networks Unit 42 has published detailed analysis of the attack techniques being used against European refrigeration infrastructure, and The Guardian described a real-world incident at a London wholesale business where refrigeration units were found reading 150°C during routine morning checks.

Why this matters for UK organisations

Cold storage infrastructure is critical to a wide range of UK sectors, including food retail and wholesale, pharmaceuticals, healthcare, and logistics. Many of the industrial controllers managing this equipment were deployed years ago, often with little consideration for network security, and may be running outdated firmware with default credentials still in place. When these devices are internet-accessible — as many are, for remote monitoring convenience — they become straightforward targets. The attack method does not require advanced capability; publicly exposed controllers with weak authentication are sufficient for an attacker to gain access and cause real harm. For sectors where temperature integrity is directly linked to product safety or regulatory compliance, the consequences extend well beyond financial loss.

What to review

UK organisations operating or responsible for refrigeration, cold-chain, or other internet-connected industrial equipment should begin by identifying which OT and IoT devices are currently accessible from the internet and whether that access is genuinely necessary. Default credentials should be changed as a baseline requirement, and firmware should be reviewed against the manufacturer's latest releases. Where remote access is needed, it should be restricted to specific authorised IP addresses and protected by strong authentication. Responsibility for OT and IoT security should be clearly assigned — these devices often fall outside the scope of standard IT security reviews, and that gap in ownership is itself a risk. The CISA and FBI advisory provides specific guidance that organisations in affected sectors should review directly.

Source: Wired Security