FBI, CISA, HHS, USDA and DOT warn of attacks on refrigeration systems worldwide

A joint advisory from the FBI, CISA, HHS, USDA and DOT on November 5, 2026, warned organizations worldwide of continuing cyber threats against refrigeration and cold chain monitoring equipment.

The agencies said hostile actors exploit flaws in unpatched temperature controllers and in internet-facing commercial refrigeration units. Cooling and cold chain systems safeguard food, medicine and other temperature-sensitive goods, the agencies said, making them appealing targets for hostile cyber actors.

These devices let operators monitor temperatures remotely, manage defrost cycles and control cooling equipment. Attackers can change temperature settings by exploiting authentication bypass flaws, arbitrary code injection or weak configurations, then drive cooling equipment into endless heating or defrost cycles. Compromises can cause inventory losses, cut short equipment life, create fire hazards, leave storage conditions unsafe and block visibility into current temperatures.

Losing sight of current temperatures inside refrigeration units is what the agencies call a denial-of-view condition. Driving a compromised refrigeration unit into heating can lead to widespread inventory loss and equipment hazards. Food or medicine kept in unsafe conditions could indirectly harm consumers if people consume those products after unsafe storage.

In October, attackers hit refrigeration controllers at an estimated 250 to 350 stores in France and turned defrost on remotely, raising temperatures inside fridges and freezers. Attackers seized control of refrigeration systems overnight and made them warm their contents, leaving hundreds of French supermarkets with spoiled stock.

In November, a wave hit more than 115 stores across six European countries. Some systems shut down completely, and temperatures rose to as high as 50 degrees Celsius, or 122 degrees Fahrenheit. A second wave struck stores in Belgium, Luxembourg and Sweden three weeks after the French attacks, and later reports added Finland, Ireland, Estonia and the Netherlands, according to Help Net Security.

On November 3, the French Blood Establishment confirmed a cybersecurity incident at a refrigeration equipment provider. The incident changed temperature and defrost settings at three blood product storage facilities.

Three of its blood banks detected a temperature spike in cold rooms, the establishment said, after attackers hit one refrigeration equipment provider. French officials said on Wednesday that hackers targeted the national emergency blood supply network and attempted to raise refrigeration temperatures at several blood banks.

Nextgov reported that the attacks hit three regional blood banks overnight, from Sunday into Monday.

Government officials believe Iran-associated hackers are behind freezer problems at approximately six military commissaries, with the trouble beginning around late August, according to reporting by Nextgov and CBS News. Six U.S. military bases reported refrigeration outages in August, and the Department of the Army Criminal Investigation Division opened an investigation into the incidents. Officials said they have not confirmed whether anyone targeted any U.S. refrigeration systems, and the joint advisory does not identify the party behind the cyber sabotage.

Chris Butera of CISA said: “Every organization that depends on refrigeration and monitoring systems should assume it could be a target.” Brett Leatherman of the FBI said the bureau is seeing these systems targeted across critical infrastructure sectors worldwide. Joshua Corman said he expects more such attacks and warned that attackers could compromise U.S. medical labs, grocery stores and bulk warehouses. Nahman Khayet of Alt Security said the incidents fit a pattern tied to Iranian hackers and that unpatched devices help Iranian operators break into critical infrastructure.

European authorities, including the European Commission, ENISA and Europol, issued a joint warning on Wednesday urging immediate steps to protect exposed equipment. Reuters initially reported that the Pentagon viewed the freezer incidents as possible cyberattacks. Help Net Security said attackers remain unidentified and that the synchronized timing of the European attacks could point to a nation-state threat actor.

The agencies urged owners to act immediately: remove refrigeration controllers from the public internet, stop exposing controller panels and control system devices to the internet, secure needed remote access, change default passwords and apply available security updates. If operators cannot avoid remote access, route it through a firewall or edge device, kept updated to its latest version. The agencies say operators should place operational technology devices on a VLAN dedicated to them, apart from business networks, change default passwords, and use phishing-resistant multifactor authentication where possible.

The agencies also recommend restricting changes with device and IP address allowlisting, keeping tested offline backups and enabling logging. Set reasonable temperature limits for devices downstream of controllers, so readings stay within safe ranges, and set alerts for any deviation. Other recommendations include isolating operational technology from business networks, enforcing safe temperature limits and retiring legacy devices vendors no longer support.

The agencies identified Healthcare and Public Health, Chemical, Food and Agriculture and Transportation Systems as sectors where refrigeration and cold chain systems are widely used. Organizations in those sectors rely on refrigeration systems that monitor and log temperatures and manage defrost cycles, including refrigerated transport. The systems also keep energy use in check. Nextgov said hospitals, pharmaceutical suppliers, chemical companies and transportation providers also depend on refrigeration systems.