Five US agencies warned on November 5 that hackers are targeting industrial refrigeration and cold-chain monitoring systems worldwide, and urged operators to take controllers off the public internet. The fact sheet from CISA, the FBI and the Departments of Health and Human Services, Agriculture and Transportation follows attacks on supermarket refrigeration across Europe and an incident that altered settings at French blood storage sites.
The agencies say attackers may use authentication bypass, arbitrary code injection and weak configurations to “remotely alter settings and force units into continuous heating and defrost cycles.” They list possible effects including fire hazards, lost inventory, shorter equipment life, harm to consumers who eat products stored unsafely, and loss of visibility into temperatures. They say such systems are widely used in healthcare, chemical, food and agriculture, and transportation.
The fact sheet names no attacker, vendor or victim. “Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity. Brett Leatherman, operations director of the FBI’s Cyber Branch, said, “We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk.”
The fact sheet tells operators to remove controller panels from the internet, isolate operational technology on a dedicated network, change default passwords, apply patches, replace unsupported devices, limit access by device and IP address, keep offline backups and set safe limits on temperature setpoints, with alerts for deviations.
US officials are also investigating refrigeration failures on American military bases. Reuters reported on October 29 that the Pentagon was treating late-August malfunctions at commissaries as a suspected hack, citing four officials familiar with the matter. Its review of base Facebook posts and websites found at least six commissaries affected. Fort Huachuca, Arizona, wrote on August 26 that its freezer “went into defrost mode where it heated up all the food.” The report could not determine how far the investigation had advanced or whether it had reached any conclusions, or whether Danfoss, whose controllers ran many of the affected French units, or any other brand was in use at the bases.
The Pentagon has since acknowledged “speculation regarding a potential cyber incident” and said its inspector general’s office was investigating, according to the Boston Globe. The Army’s Criminal Investigation Division said its Cyber Field Office was involved and was working with French law enforcement to understand “the refrigeration outages in Europe.”
The October attacks in France hit hundreds of supermarkets. Danfoss has said many of the affected controllers were obsolete or running outdated firmware. The attackers in Europe have not been publicly identified.
The fact sheet does not say whether any US grocery or cold storage operator has been hit. In December 2025, federal prosecutors in Los Angeles accused a Ukrainian woman of belonging to a hacker group that knocked out refrigeration at a meatpacking facility in 2024, ruining more than 2,000 pounds of meat. In August, CISA, the FBI and other agencies warned that attackers were using AI to write exploit scripts against Siemens controllers used at water and power facilities.
Sources: CISA, Reuters, Boston Globe
–
By the Control Plane Editorial Team