Cold storage controls
What Bendings found in networked freezer controllers, and when it told US officials.
Research note
Cold storage controls: what Bendings found and when it told US officials
Between February and April 2026, Bendings tested networked refrigeration and freezer controllers used by commercial food distribution clients in the United States. Engineers found that several controllers accepted remote commands with weak or missing authentication and could be made to report false temperatures while food spoiled unnoticed. Bendings summarized the findings in a written note to a federal infrastructure security contact on April 21, 2026, and recommended that facilities serving military installations check similar equipment. A suspected cyberattack on military base freezers was later reported in the press.
Published Updated
freezer and refrigeration controllers tested at three distribution sites
accepted remote temperature and defrost commands without valid authentication
a controller was held at a false temperature reading in the lab
the actual compartment warmed while the reading held
The evidence.
5 records, in the order they were made, from the first test log to the reply from the federal contact.
- 01
to
Test logs
Test logs dated February 24 through April 2, 2026, covering 31 freezer and refrigeration controllers at three distribution sites, record 14 devices that accepted remote temperature and defrost commands without valid authentication.
- 02
Lab reproduction
A lab reproduction on March 30, 2026, using firmware obtained with client permission, showed a controller could be silently held at a false temperature reading for 11 hours while the actual compartment warmed by 19 degrees.
- 03
Firmware review
Firmware analysis was reviewed by two researchers who joined Bendings through the 2026 acquisition of Scopertos, a vulnerability research firm. The weakness was a configuration and code issue in the controllers, not a zero-day, and no exploit was sold or reserved for any party.
- 04
Note to federal contact
An email dated April 21, 2026, from Bendings to a federal infrastructure security contact, lists the affected controller models, the observed failure mode, and a recommendation to inspect similar equipment at cold storage facilities that serve military bases.
- 05
Reply
A reply dated April 29, 2026, from the same contact acknowledges receipt and states the findings were passed to the relevant sector team.
What this page claims.
This page records what was found, when it was found, and when it was shared. It does not state that the later reported attack used the same weakness, only that Bendings identified and reported the exposure roughly four months before the attack was reported.
Discuss a seam-led test.
Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.