U.S. agencies warn of attacks on refrigeration control systems

U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide. The joint advisory says attackers may exploit unpatched or internet-accessible controllers to alter settings remotely, forcing equipment into continuous heating or defrost cycles that can create fire hazards, damage equipment and destroy temperature-sensitive inventory.

The warning was issued by the Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation. The agencies said the affected systems support food, medicine and other products whose safe handling depends on reliable temperature control.

Manipulated settings can create physical consequences

Attackers are likely to exploit authentication bypasses, arbitrary code injection and weak configurations to gain access to refrigeration controllers. Once inside, they could change temperatures, reduce system service life, create a fire hazard, cause inventory losses or expose consumers to products stored under unsafe conditions.

A denial-of-service attack can also remove operators' visibility into current temperatures. That loss of monitoring can delay a response while refrigeration conditions deteriorate, particularly where equipment is managed remotely or distributed across multiple sites.

FBI Cyber Branch Operations Director Brett Leatherman said industrial refrigeration and cold-chain monitoring systems are attractive targets because they protect food, medicine and other temperature-sensitive goods. He said such systems are being targeted across critical-infrastructure sectors globally, putting both inventory and equipment at risk.

European incidents show the exposed attack surface

In recent weeks, threat actors targeted hundreds of supermarkets in Europe by abusing weaknesses in internet-accessible refrigeration controllers. The attacks reportedly raised temperatures in some cases to 50 degrees Celsius, or 122 degrees Fahrenheit, and forced cooling units into defrost mode, spoiling food and causing financial losses.

Targets included major supermarket chains as well as small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden and the United Kingdom. The French Blood Establishment also confirmed an incident affecting a refrigeration-equipment provider that raised temperature and defrost settings to extremely high levels at three blood-plasma storage facilities.

Censys reported that internet exposure remains substantial despite declines in visible instances. Danfoss StoreView exposure fell from 3,004 instances on October 9 to 708 on November 5, 2026, while Copeland/Dixell XWEB exposure declined from 3,708 to 2,420. Censys said North America accounts for roughly 38% of global industrial control system exposure and warned that high exposure remains a critical public risk.

Actions for operators

The agencies urge owners and operators to identify systems reachable from the internet, use strong authentication, keep systems updated and change default passwords. They also recommend isolating operational technology devices, retiring or replacing legacy equipment, removing unnecessary remote access and securing remote access that must remain available.

For businesses, the immediate implication is to treat refrigeration controllers as operational technology with direct physical and financial consequences: inventory exposed devices, reduce external access and verify that temperature monitoring and remote-control safeguards are working before a disruption becomes a safety or inventory event.