---
title: Tip: find your refrigeration and cold-chain controllers on the internet this week, then lock down setpoints | ctxsec
url: https://ctxsec.com/items/tip-find-internet-exposed-refrigeration-controllers-before-attackers-do
description: "The attacks in Europe and the new U.S. fact sheet point at the same weak spot: controllers and vendor remote-monitoring paths that anyone can reach. A few checks close most of it."
status: "official guidance (CISA-led joint fact sheet, Nov 5)"
published: 2026-11-05
---

> The attacks in Europe and the new U.S. fact sheet point at the same weak spot: controllers and vendor remote-monitoring paths that anyone can reach. A few checks close most of it.

[← Tips & Guides](/tips) · [markdown](/items/tip-find-internet-exposed-refrigeration-controllers-before-attackers-do.md)

official guidance (CISA-led joint fact sheet, Nov 5)

2026-11-05

### Tip: find your refrigeration and cold-chain controllers on the internet this week, then lock down setpoints

- **Inventory:** ask facilities and your refrigeration contractor for every controller, gateway and remote-monitoring service, including the contractor's own access path (the EFS incident came in through a contractor's monitoring).
- **Exposure:** scan your external ranges and check Shodan/Censys for your IPs; any controller web UI or protocol answering from the internet should come off it or go behind a VPN.
- **Credentials:** change defaults, remove shared vendor logins, and require MFA on the remote-access path.
- **Setpoints:** configure hard min/max limits and alerts on deviation, so a remote change to heating or defrost gets noticed in minutes, not hours.
- **Separate:** put the controllers on an OT VLAN and allowlist which hosts may change settings.

Sources: [CISA: US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems (Nov 5)](https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems)