US federal agencies have issued a joint cybersecurity warning after a series of attacks demonstrated how hackers can remotely manipulate commercial refrigeration equipment. The threat extends beyond supermarkets to hospitals, food suppliers, transportation companies, and other organizations that depend on controlled temperatures.
The advisory, released on November 5, 2026, was issued by the FBI and the Cybersecurity and Infrastructure Security Agency (CISA), alongside the Departments of Health and Human Services, Agriculture, and Transportation. Officials warned that attackers are exploiting security weaknesses in industrial refrigeration controllers and cold-chain monitoring systems.
These devices allow businesses to monitor temperatures, manage cooling cycles, and adjust equipment remotely. However, controllers exposed directly to the internet, running outdated software, or using weak authentication can provide attackers with opportunities to interfere with their operation.
According to the agencies, malicious actors may exploit authentication bypass vulnerabilities, code injection flaws, and insecure configurations to change temperature settings or activate continuous defrost cycles. Some attacks can also interfere with temperature monitoring, making it harder for operators to identify dangerous conditions.
The consequences can extend beyond spoiled inventory. Federal officials warned that compromised refrigeration systems could suffer equipment damage, reduced operational lifespans, and increased fire risks. In healthcare and pharmaceutical facilities, improper storage temperatures could also threaten the safety of temperature-sensitive products.
The warning follows two waves of cyberattacks against European supermarkets. During October, hackers reportedly compromised refrigeration equipment at an estimated 250 to 350 stores in France, remotely changing cooling settings and forcing businesses to discard products.
Further attacks in early November affected more than 115 stores across six European countries. Some refrigeration units were reportedly configured to reach temperatures of 50°C (122°F), while others were forced into defrost mode or stopped operating normally.
The threat also reached medical facilities. On November 3, France’s national blood service, Établissement Français du Sang (EFS), confirmed that refrigeration equipment at three locations had been targeted. Monitoring alarms alerted employees, who secured the affected supplies before any blood products or samples were lost.
The FBI and CISA emphasized that organizations should not assume refrigeration equipment is safe simply because it operates outside conventional corporate IT systems. Internet-connected industrial controllers can present security risks when they are not properly maintained or protected.
The agencies recommend removing refrigeration controllers from direct public internet access, securing necessary remote connections behind firewalls, changing default passwords, and installing available security updates. They also advise separating operational technology from business networks and configuring safe temperature limits and effective monitoring alerts.