Five U.S. agencies warn of attacks on refrigeration and cold-chain systems

Five U.S. federal agencies issued a joint warning on Nov. 5, 2026, about active cyber threats against industrial refrigeration and cold-chain monitoring systems used across critical infrastructure sectors.

The warning covers commercial refrigeration controllers and electronic temperature controllers used by retailers and cold storage operators. Healthcare, chemical, food and agriculture, and transportation sectors rely on these systems for refrigerated transport, temperature monitoring and logging, defrost cycle management, and energy use control.

Hackers could use authentication bypasses, code injection, or weak configurations to change settings and force refrigeration units into continuous heating or defrost cycles. Successful exploitation could let actors change temperatures and cause physical impacts such as fire hazards, inventory loss, and reduced equipment service life. Consequences include denial-of-view conditions, in which current temperatures cannot be seen, and potential indirect harm to consumers if consumers consume unsafe products.

On Oct. 11, attackers compromised hundreds of supermarkets by raising fridge temperatures to 50 degrees Celsius (122 degrees Fahrenheit) and setting freezers to defrost, which spoiled food and caused fires in some cases. On Nov. 2, Dutch attacks hit refrigeration systems at 17 businesses, chiefly butcher shops and small neighborhood stores, while major supermarket chains were reportedly unaffected. A second wave struck over 100 supermarkets and one blood bank this week, with losses limited to supermarkets; rapid staff intervention protected blood products and samples, the French Blood Establishment (EFS) said.

France’s national blood service confirmed that attacks affected monitoring and control systems at three cold-storage sites, but staff acted in time to protect blood products and samples. The French Blood Establishment (EFS) also said three of its blood banks saw a temperature spike in cold rooms following an attack on one of its refrigeration equipment providers.

Help Net Security reports that since October, attackers remotely hijacked refrigeration systems in hundreds of French supermarkets overnight, setting them to warm contents; a second wave later hit Belgium, Luxembourg, Sweden, and subsequently Finland, Ireland, Estonia, and the Netherlands. Industrial Cyber reports a new wave of suspected refrigeration cyber attacks hit supermarket chains in Sweden, Belgium, and Luxembourg. Industrial Cyber reports the new European wave followed earlier intrusions in hundreds of French stores where attackers reportedly manipulated cooling equipment, causing substantial food losses.

Censys counted 6,695 exposed refrigeration controllers in an Oct. 9 scan, and by Nov. 5 only 3,124, or 47 percent, were still reachable online. Censys analysis covers Copeland/Dixell XWEB and Danfoss StoreView controllers, with XWEB exposure falling 35 percent from 3,708 to 2,420 and StoreView falling 76 percent from 3,004 to 708.

On Oct. 13, after early attacks in France, Danfoss told Dutch customers to take refrigeration systems off the public internet and use only a secure network for reconnection. Danfoss said the compromised systems were still reachable over unsecured links with default passwords, and that following recommended precautions would have prevented the attacks. Danfoss said most stores followed its advice to disconnect from the public internet.

Modern refrigeration systems rely on remote connectivity so outside technicians can check temperatures, handle alarms, find faults, and service equipment at many sites, but this adds entry points when equipment faces the public internet directly. Secomea says suppliers may use different access methods, complicating oversight of connections to critical infrastructure for IT and security teams. “When attackers interfere with operational technology, the consequences become physical,” said Michael Ferdinandsen, CEO at Secomea. He said interfering with operational technology creates immediate physical effects such as spoiled food, interrupted operations, financial losses, and food safety risks.

Secomea says AK-Centralen in Denmark uses its technology to monitor cooling systems for more than 1,500 supermarkets without direct access to their internal networks. Secomea CEO Michael Ferdinandsen says refrigeration systems were designed to run reliably for years or decades without today’s connectivity and cybersecurity requirements.

Owners should take control system devices offline, change default passwords, apply patches, and retire unsupported legacy devices. Additional recommendations include isolating OT devices on dedicated VLANs, using phishing-resistant multifactor authentication, keeping firmware updated, maintaining offline backups, enabling logging, setting safe temperature setpoint limits, and configuring alerts for deviations. When remote access cannot be avoided, a firewall or edge device kept current should protect the systems.

The agencies recommend limiting who can change settings through device and IP address allowlisting. Operators should keep tested offline backups of refrigeration control systems. Leatherman urged organizations to review the guidance, apply mitigations, and report suspicious activity to the FBI.

Chris Butera, CISA’s acting executive assistant director for cybersecurity, said any organization using refrigeration and monitoring systems should assume attackers might target it. “In close collaboration with our government, industry and international partners, CISA is actively tracking this threat activity,” Butera said. Brett Leatherman, FBI Cyber Branch operations director, said attackers target these systems worldwide across critical infrastructure sectors, endangering inventory and equipment. “Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” Leatherman said.

Attribution remains unconfirmed, with Russian hacktivist groups reportedly claiming involvement and Iranian hacktivists or state-sponsored actors also considered possible. SecurityWeek reports that Russian hacktivist groups Noname057(16) and Z-Pentest Alliance reportedly claimed to have hacked Danfoss, leading to unconfirmed speculation they mounted the attacks. SecurityWeek reports that BBC says state-sponsored hackers or Iranian hacktivists could be responsible. Help Net Security reports that attackers’ identities are unknown, but synchronized timing across several European countries suggests a nation-state threat actor may be responsible.

SecurityWeek reports that over the past weeks, attacks on European supermarket and blood bank refrigeration systems caused millions in losses. Industrial Cyber reports investigators were still examining the suspected supermarket attacks as of Nov. 3. Industrial Cyber notes that failures in operational technology security can rapidly turn into business continuity problems.