The short answer: On November 5, 2026, CISA, the FBI, HHS, USDA, and DOT warned that attackers are actively going after internet-reachable and unpatched refrigeration controllers in US grocery stores, cold storage, and other cold chain operations. The fix list is short and unglamorous: get the controllers off the internet, change default passwords, patch, and replace anything the vendor no longer supports. If you run refrigeration, or you insure, finance, or supply someone who does, this is now a US problem, not a European one.
Three weeks ago we wrote about the overnight attack that spoiled stock in hundreds of French supermarkets. Since then the activity has spread to more countries, reached a French blood service, and turned up on US military bases. The joint US fact sheet is the government saying out loud what that pattern implies: “Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” in the words of Chris Butera, CISA’s acting executive assistant director for cybersecurity.
How we got here
| When | What happened |
|---|---|
| Aug 2026 | Refrigeration units in grocery stores on US military bases malfunction. Reuters later reports that Pentagon investigators are treating them as a cyberattack. |
| Oct 11–12, 2026 | Hundreds of French supermarkets lose refrigerated stock overnight after controllers are forced into defrost. ANSSI tells operators to disconnect them from the internet. |
| Oct 2026 | Three French blood banks (EFS) see temperature spikes in cold rooms after one of their refrigeration equipment providers is hit. The attack is stopped before blood stores are lost. |
| Early Nov 2026 | A second wave reaches stores in Belgium, Luxembourg, and Sweden, with later reports adding Finland, Ireland, Estonia, and the Netherlands. |
| Nov 5, 2026 | CISA, the FBI, HHS, USDA, and DOT publish a joint fact sheet warning of ongoing activity against US refrigeration and cold chain monitoring systems. |
Who is behind it. The US government has not named a group or a country. Press reports cite researchers and unnamed US officials pointing toward Iran, and the synchronized timing across several European countries has led analysts to suggest a state-backed actor. Treat that as unconfirmed. For defenders, the attribution changes very little: the devices being hit were reachable, outdated, or weakly protected, and that is equally useful to a state, a criminal crew, or a bored teenager.
What the advisory actually says
The agencies describe attackers getting in through controllers that are unpatched or reachable from the internet, using authentication bypass, code injection, and weak configurations. Once inside, they change set points to force units into heating or continuous defrost. The consequences named in the advisory are inventory loss, shortened equipment life, and fire hazards.
One detail deserves more attention than it has received: the agencies also warn of a “denial-of-view” condition, where operators can no longer see current temperatures. That is the difference between a nuisance and a loss. A store that sees a temperature alarm at 1 a.m. can send someone. A store whose dashboard shows normal readings, or nothing at all, finds out when staff open the doors.
The four headline mitigations, verbatim:
- “Remove control system devices and/or systems from the internet.”
- “Change default passwords and strengthen passwords.”
- “Apply patches and keep devices and systems updated.”
- “Identify, retire, and replace legacy devices that the vendor no longer supports.”
The fact sheet goes further: route any required remote access through a current firewall or edge device, put OT on a dedicated VLAN, enable phishing-resistant MFA where possible, allowlist who can make changes, keep tested offline backups, enable logging, and set alerts for set-point deviations.
It isn’t only grocery stores
The advisory names four critical infrastructure sectors that rely on industrial refrigeration and cold chain monitoring. If your business sits in any of them, or sells to one, assume the warning applies.
| Sector | Where the controllers live | What a bad night costs |
|---|---|---|
| Food and agriculture | Grocery chains, distribution centers, cold storage warehouses, processors | Spoiled inventory, food-safety reporting, closed stores |
| Healthcare and public health | Pharmacies, blood banks, vaccine and biologics storage, hospital labs | Destroyed medicine and blood products, patient-care delays |
| Transportation | Reefer trailers, cold chain logistics, telematics platforms | Rejected loads, broken temperature-compliance records |
| Chemical | Temperature-sensitive feedstocks and storage | Product degradation and, in the worst case, safety incidents |
The EFS incident in France is the one healthcare leaders should read twice. The blood service wasn’t breached directly. One of its refrigeration equipment providers was, and the temperature spikes followed. Your attack surface includes every contractor with a remote path into your cold rooms.
What to do this week
None of this requires a new product or a six-month program. It requires someone to own the list of connected cold chain devices and work through it in order.
Take controller dashboards off the internet
CriticalNo refrigeration controller, temperature monitor, or BMS panel should answer on a public IP. If a technician needs remote access, put it behind a VPN or a fully patched firewall with individual logins.
Change every default password
CriticalInclude the controller, the store router, and any cellular modem a contractor installed. Turn on phishing-resistant MFA anywhere the device or the remote-access gateway supports it.
Find and replace unsupported controllers
HighModels the vendor no longer updates are permanent risk. Isolate them now, limit access to known IP addresses, and put a replacement date and budget on each one.
Move OT onto its own network segment
HighPut refrigeration and monitoring devices on a dedicated VLAN, separate from point-of-sale, office, and guest Wi-Fi. A VLAN alone is not a barrier if traffic routes freely between segments: enforce default-deny firewall rules or ACLs between them, allowing only the specific management and monitoring traffic you need, so one compromised laptop or camera can't reach the controllers.
Alert on set-point changes, not just outages
HighDefine safe temperature ranges and alarm on any change outside them, plus forced-defrost or heating modes outside a maintenance window. The French attack worked because nobody noticed overnight.
Keep offline backups of controller configurations
MediumExport and store configurations where an attacker can't reach them, and enable logging on the controllers and the remote-access path so you can reconstruct what changed.
A word of caution on scanning. Check your exposure from the outside first, by looking at what your own public IP ranges reveal. Don’t point aggressive active scans at live controllers on the inside without the vendor: some older embedded devices crash when probed, and a crashed controller is its own outage.
Questions for your refrigeration contractor
- Which of our controllers and monitors can be reached from the internet, and how?
- How do your technicians connect remotely, and does every technician have an individual login with MFA?
- Which of our models are past end-of-support, and what does replacement cost?
- What firmware does each unit run, and when was it last updated?
- Will we be alerted if a set point changes or a unit goes into defrost outside the schedule?
- If the dashboard goes dark, what is the manual check, and who does it?
If your contractor can’t answer the first two, that is the finding.
For executives: why this belongs on the risk register
- The loss is physical. Spoiled stock, destroyed medicine, and damaged compressors can’t be restored from backup.
- The federal government has now put you on notice. After a named, multi-agency advisory, “we didn’t know” is a harder position with insurers, auditors, and regulators.
- Check your insurance wording. Some cyber policies treat physical damage and spoiled inventory differently from data loss. Find out before you need to claim.
- Vendor contracts should say who patches what. If your service contractor installed the remote access, the contract should state who maintains it and how fast.
See What Your Cold Chain Exposes to the Internet
Scan Ninja maps what's reachable on your public IP ranges, including the controller dashboards and remote-access gateways that refrigeration and building systems leave exposed. We rank findings by real exploitability and business impact, then take you from findings to verified fixes.
Sources
- CISA, FBI, HHS, USDA, and DOT urge critical infrastructure to strengthen industrial refrigeration and cold chain monitoring systems cybersecurity — CISA (agencies, sectors, mitigations, quotes)
- US partners urge hardening of industrial refrigeration and cold chain monitoring systems (fact sheet) — CISA (full fact sheet)
- US government warns of 'ongoing cyber threat' amid mass hacks of industrial retail and military freezers — TechCrunch (military bases, EFS, attribution reporting)
- US agencies warn attackers are targeting refrigeration systems that protect food and medicine — Help Net Security (second wave, entry methods, detailed recommendations)
- US warns of 'ongoing cyber threat' to industrial refrigeration systems — CNBC (Reuters report)