Refrigeration Cyberattacks Draw FBI and CISA Warning
Five U.S. federal agencies have issued a joint warning about refrigeration cyberattacks, saying threat actors are targeting refrigeration controllers and electronic temperature controllers in retail grocery and cold storage facilities. The fact sheet, released on November 5, 2026, by CISA, the FBI, HHS, USDA and the Department of Transportation, says attackers can remotely alter settings and push units into continuous heating and defrost cycles.
The warning follows weeks of overnight freezer incidents at supermarkets across Europe, an attack that hit blood storage sites in France and reported hacks of freezers on U.S. military bases. The fact sheet itself names no products, victims or attackers.
What the FBI and CISA Refrigeration Warning Says
The fact sheet, titled “US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems,” is marked TLP:CLEAR and carries no advisory number. It is addressed to the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors, including refrigerated transport services.
The agencies say the actors may exploit vulnerabilities or weaknesses in controllers that are unpatched or reachable from the internet. They list three access paths:
- Authentication bypass: Reaching controller functions without valid credentials
- Arbitrary code injection: Running attacker-supplied code on the device
- Weak configurations: Insecure settings that leave a controller open to remote tampering
The document does not say which of these paths was used in which incidents, and it does not state that default credentials were the entry point. Default passwords appear only in its list of mitigations.
From Setpoint Changes to Fire Hazards
These controllers let operators watch temperatures remotely, schedule defrost cycles and run cooling equipment. Anyone who takes them over can do the same. The agencies list the following potential consequences:
- Temperature changes: Stored goods warm beyond safe limits
- Loss of inventory: Food, medicine or other temperature-sensitive stock has to be discarded
- Equipment wear: Forced heating and defrost cycles shorten the service life of the system
- Fire hazard: Equipment pushed outside normal operation can create a fire risk
- Denial of view: Operators lose visibility into current temperatures
- Indirect consumer harm: Products that spoiled unnoticed could reach customers or patients
The denial-of-view effect deserves attention. A site that relies on the controller itself to raise an alarm may not learn about a change until staff open the cases in the morning.
Cold Chain Cyberattacks Behind the Warning
The fact sheet does not reference specific events, but U.S. officials issued it in the middle of a fast-moving campaign against cold chain equipment. Reporting on the warning places it against this background:
| When | Where | What Was Reported |
|---|---|---|
| October 2026 | France | An estimated 250 to 350 supermarkets hit, with refrigeration forced into defrost and heating cycles |
| November 2026 | Six European countries | A second wave affecting more than 115 stores, with some units shut down and others raised as high as 50°C (122°F) |
| November 3, 2026 | France | The French Blood Establishment (EFS) confirmed an incident at a refrigeration equipment provider that altered temperature and defrost settings at three blood product storage facilities |
| Ongoing | United States | The Department of Defense is investigating a series of hacks targeting freezers run by the military |
Store counts differ between outlets and between French official and media figures, so the numbers above should be read as estimates. Separate coverage describes several waves across at least a dozen countries and reports that the blood bank attack was stopped before it compromised blood stores.
We have followed this campaign since its first wave. Our analysis of the French supermarket cyberattack explains how exposed refrigeration controllers left hundreds of French stores open to overnight tampering in October. Our latest report, Supermarket Freezer Attacks Reach Belgium, Sweden, Luxembourg, covers the November 2 wave in detail, including the retailers that reported problems, the contractor’s account of evaporators switched into defrost mode and how national cyber agencies responded.
Which Equipment Has Been Linked to the Attacks?
The U.S. agencies name no vendor. In Europe, more detail has emerged. France’s CERT-FR alert on the October incidents addressed remotely managed refrigeration controllers exposed to the internet and warned that end-of-life units left online were very likely to be compromised again.
Media reporting says some affected systems were remote-controlled Danfoss refrigeration units that no longer received security updates. That detail comes from reporting, not from the U.S. fact sheet, and it does not mean every incident involved one vendor. More than one manufacturer’s equipment has been named in the French incidents.
Has the U.S. Named a Culprit?
No. The United States has not attributed the attacks to a group or government, and the fact sheet makes no attribution. Security researchers have broadly linked the campaign to Iran, and U.S. officials reportedly suspect Iran as well, but neither claim has been confirmed in an official statement.
Until an agency publishes an attribution with supporting evidence, the Iran link should be treated as an assessment by researchers and anonymous officials. Defensive priorities do not depend on it: the same exposed controllers are within reach of any actor, whatever their motive.
Eight Ways to Secure Refrigeration Controllers
The agencies tie each recommendation to CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs):
| Mitigation | What It Involves | CPG |
|---|---|---|
| Remove internet exposure | Take controllers, especially controller panels, off the public internet; if remote access is required, place it behind an updated firewall or edge device | 3.S |
| Isolate OT devices | Move controllers to a dedicated OT VLAN separate from business networks | 3.I |
| Secure credentials | Change default passwords, enforce strong password policies and use phishing-resistant MFA wherever feasible | 3.A, 3.B, 3.F |
| Patch and retire | Keep firmware updated and run a lifecycle process to replace end-of-life devices | 2.A, 2.B |
| Restrict access | Allowlist the devices and IP addresses permitted to connect | 3.H |
| Keep backups | Maintain tested offsite and offline backups of configurations | 3.O |
| Monitor and report | Enable logging, and capture network traffic for OT assets that cannot log | 3.Q |
| Bound setpoints | Define allowed setpoint ranges for downstream devices and alert on any deviation | Not specified |
The agencies ask organizations to report incidents to CISA, the FBI’s IC3 or, for healthcare entities, HHS, including the date, location, type of activity, number of affected units and equipment type.
Turning the Guidance Into Contractor Checks
Many grocers and cold storage operators do not manage these controllers directly. A refrigeration maintenance firm often holds the remote access path and the credentials. Beyond the agencies’ list, these checks help turn the guidance into action:
- Remote access: Confirm how the contractor connects to each site and whether any controller is directly reachable from the internet
- Credentials: Find out who holds controller passwords and verify that factory defaults are changed on every unit
- Support status: List the controllers that have reached end of life and no longer receive firmware updates
- Independent alarms: Check that temperature alarms still fire if the controller is tampered with or stops reporting
- Change records: Make sure setpoint and defrost changes can be traced to a user, time and source address
How Can SOCRadar Help?
The incidents in this campaign have involved controllers that could be reached remotely, and security teams often do not know those interfaces exist. SOCRadar can narrow that blind spot:
- Attack Surface Management: Identifies internet-facing refrigeration and building management interfaces across your IP space, including ones a contractor set up, so they can be taken offline or placed behind secured access
- Supply Chain Intelligence: Monitors the security posture of refrigeration and OT service providers and flags signs that a supplier may be compromised
- Cyber Threat Intelligence: Tracks new waves, targeted sectors and attribution updates as agencies and researchers publish them
External monitoring shows where controllers are exposed. Confirming whether a specific unit’s settings were changed still requires its own configuration history and event logs.
