Five U.S. federal agencies warn of hacking targeting refrigeration systems worldwide

Five U.S. federal agencies — CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation — issued joint guidance Thursday, Nov. 5, 2026, warning that hackers are targeting refrigeration systems worldwide.

American officials said on Nov. 5, 2026, that they believe Iran-linked hackers caused freezer problems at military bases nationwide. The failures started around late August and hit about six commissaries, which are on-base grocery stores serving military personnel.

At least one incident in late August at Fort Huachuca, Arizona, saw cooling unit temperatures raised overnight, leaving mounds of wilted or melted food by morning. A Facebook post from Fort Huachuca on August 26 said the base freezer went into defrost mode where it heated up all the food, and the account said the food was spoiled. A blog called Signal and Silence first reported the rogue freezer behavior on August 28.

In France, hackers struck three regional blood banks overnight Sunday into Monday, targeting their refrigeration systems. The French Blood Establishment said on Nov. 5, 2026, that cooling unit controls at three national blood banks were tampered with. French officials said Wednesday this week that hackers targeted the national emergency blood supply network by attempting to raise temperatures in refrigeration units at several blood banks.

Attackers are going after electronic temperature controls in grocery stores and cold storage facilities. This week, attacks on supermarkets drove refrigerator temperatures up at stores in Sweden, Belgium, Luxembourg and other countries, forcing stores to throw away food. Grocery sellers reported this week that unexpected temperature spikes caused food to spoil at stores in Luxembourg, Belgium and Sweden. Hackers used two separate attack waves this week to raise temperatures on freezers and chilling units across at least a dozen countries including the United Kingdom, spoiling thawed food and ruining produce.

Attackers hit hundreds of French establishments in October, preceding the more recent incidents. Intruders overrode temperature controls on commercial cooling units at more than 350 French establishments in a freezer cyber attack on Oct. 29, 2026, and some units caught fire after they turned temperatures up so high. A supermarket owner estimated earlier this month that the French attack’s nationwide costs could reach tens of millions of euros.

The guidance says intruders could make refrigerators and freezers run continuous heating or defrost cycles and could prevent operators from seeing current temperatures inside the units. Officials warned of fire hazards and possible harm to consumers using products stored at unsafe temperatures. Digital flaws in refrigeration controls can expose equipment to hacking and sabotage, especially internet-connected devices used to remotely monitor or control temperatures.

Bad actors could exploit weaknesses in unpatched or internet-connected controllers to force units into endless heating and defrost cycles, causing inventory loss and equipment hazards. Healthcare providers, drugmakers, chemical firms and transportation companies also rely on refrigeration and monitoring systems. Widely used cooling systems in healthcare, transportation, food and chemicals rely on automated remote temperature monitoring and energy optimization, manage defrost cycles and keep continuous temperature logs.

European officials issued a joint warning on Wednesday this week urging immediate steps to secure exposed equipment. The European Commission, ENISA, Europol and national authorities are coordinating the response and sharing incident information.

Operators should remove control systems from the public internet and protect any remote access they continue to use. Officials advised separating refrigeration controls from business networks, changing default passwords, applying security updates and removing outdated equipment no longer supported by manufacturers. Agencies told industries to take remote control systems offline, update passwords, apply patches and retire equipment no longer supported by vendors.

The American advisory does not identify the party responsible for the cyber sabotage, and American authorities have not blamed a specific group for the hacks. Security researchers largely pointed to Iran on Nov. 5, 2026, and Washington officials suspect Iran is the likely culprit. Chris Butera is CISA’s acting executive assistant director for cybersecurity. “Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said CISA’s acting executive assistant director for cybersecurity Chris Butera.