The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Health and Human Services (HHS), US Department of Agriculture (USDA), and Department of Transportation (DOT) recently released a Joint Fact Sheet warning that malicious cyber actors are targeting vulnerable electronic temperature controllers and commercial refrigeration controllers used across the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems critical infrastructure sectors.
Successful exploitation may result in temperature manipulation, fire hazards, inventory loss, impacts to the service life of the system, and disrupted operations.
Immediate mitigations include:
- Remove public internet exposure for controller system devices and/or systems and secure necessary remote access.
- Change default passwords and implement stronger password policies—including multi-factor authentication, if possible.
- Isolate operational technology (OT) from business networks.
- Apply patches and firmware updates.
- Identify, retire, and replace legacy devices the vendor no longer supports.