FBI, CISA warn of cyberattacks targeting refrigeration systems

U.S. authorities are urging grocery stores, cold-storage operators and other organizations to secure refrigeration controllers following suspected cyberattacks affecting European supermarkets, French blood banks and several U.S. military commissaries.

In a joint advisory issued Nov. 5, the FBI and Cybersecurity and Infrastructure Security Agency (CISA), alongside the departments of Health and Human Services, Agriculture and Transportation, warned that attackers could exploit internet-connected cooling systems to disrupt temperatures and spoil critical supplies.

Officials said vulnerable controllers may be compromised through authentication bypasses, arbitrary code injection, default credentials and insecure configurations. Once inside, an attacker could manipulate refrigeration equipment, potentially forcing it into defrost or heating modes.

The advisory recommends that operators identify refrigeration systems exposed to the internet, remove unnecessary remote access, secure any connections that must remain available, deploy strong authentication and install security updates.

Attacks can threaten food and medical supplies

Refrigeration controllers are widely used in supermarkets, warehouses, food-processing facilities, pharmacies, blood banks and military commissaries. A successful attack does not need to involve ransomware or data theft to cause serious harm.

Melvin Lammerts, co-founder and head of hacking at cybersecurity company Hadrian, said the warning reflects incidents in which attackers allegedly reached poorly secured or publicly exposed temperature controllers.

“In each case the attackers didn’t need sophisticated malware. They reached internet-exposed or poorly secured temperature controllers and forced them into defrost or heating mode,” Lammerts said.

He advised cold-chain operators to remove controllers from the public internet, change default passwords, install available patches and isolate operational technology, or OT, networks. Organizations should also configure hard temperature limits to prevent equipment from being pushed beyond safe operating ranges.

Robert Costello, chief digital and information officer at Merlin Group, noted that operational disruption can directly affect public safety. Food can become unsafe, while blood, vaccines and other temperature-sensitive medical products may be rendered unusable.

The financial consequences can also continue after systems are restored, Costello said, because organizations may face spoiled inventory, damaged equipment and lost business.

Responsibility remains unclear

No confirmed attribution has been announced for the reported incidents. The Pentagon has investigated freezer malfunctions at commissaries on U.S. military bases, while pro-Russian hacktivist groups have claimed responsibility for attacks in Europe. Those claims have not been independently verified.

The lack of attribution does not reduce the immediate risk. Security specialists warned that copycat attackers could target other exposed controllers using publicly available documentation, automated scanning tools and known factory credentials.

Jason Brown, director of customer advisory and counter-fraud lead at iCounter, said controller manufacturer Danfoss had previously instructed customers to disconnect affected devices from the internet. According to Brown, researchers later observed login attempts against decoy systems designed to resemble refrigeration controllers, with many attempts using factory-default passwords published in manufacturer documentation.

Brown said the pattern appeared consistent with attackers identifying devices that remained exposed. He added that more than 100 sites across at least nine countries had reportedly been affected over two waves of activity.

Legacy technology creates persistent risk

Many refrigeration and building-control systems were installed years or even decades ago, when cybersecurity was not a central design requirement. Some run outdated software, no longer receive security updates or depend on remote connections maintained by third-party contractors.

Replacing this equipment is rarely straightforward. Refrigeration systems may need to operate continuously, and smaller businesses may lack dedicated cybersecurity staff or the funding required for rapid upgrades.

Duncan Greatwood, chief executive of Xage Security, said organizations should not depend solely on patching. Older controllers may have no patches available, while attackers can also compromise the wider networks to which newer systems are connected.

“Companies need to enforce security controls in front of these systems rather than relying solely on the equipment’s built-in protections,” Greatwood said.

Such controls can include network segmentation, identity-based access restrictions and monitoring that detects unauthorized commands or unusual temperature changes.

Warning extends beyond refrigeration

The underlying security problems are not limited to freezers and cooling units. Internet-connected OT and Internet of Things devices are also used for heating and air conditioning, lighting, building automation, physical security and access control.

John Gallagher, vice president at Viakoo, said the federal recommendations should be applied broadly across these environments. Automated cyber hygiene can help organizations keep firmware current, replace default passwords and identify devices that do not meet security requirements.

Gallagher said the concentration of incidents could indicate either multiple waves of copycat attacks or a coordinated campaign. Regardless of the source, he argued that organizations should use the warning to improve security practices across all OT and IoT assets.

Questions operators should ask

Responsibility for refrigeration systems is often divided among store owners, equipment vendors and outside maintenance companies. A franchise owner or independent retailer may not know how a contractor connects to a controller or whether the device is publicly accessible.

Brown recommended that organizations ask their refrigeration and building-maintenance providers three immediate questions:

• Is any refrigeration controller reachable directly from the internet?
• Have all factory-default credentials been replaced?
• How do technicians authenticate when connecting remotely?

Store managers should also treat unexpected temperature alerts as potential cybersecurity incidents rather than assuming they are ordinary equipment failures. A single warming freezer may look like a maintenance problem, but simultaneous failures across multiple locations can signal coordinated malicious activity.

Recommended defensive measures

Organizations operating refrigeration or other building-control systems should take the following steps:

• Inventory all controllers and identify internet-facing devices.
• Remove direct public access wherever possible.
• Require multifactor authentication for necessary remote connections.
• Replace default, shared and weak passwords.
• Apply current firmware and software updates.
• Segment refrigeration equipment from corporate and guest networks.
• Restrict access to authorized employees and service providers.
• Monitor temperature changes, login attempts and configuration updates.
• Establish safe operating limits that cannot be remotely overridden without additional authorization.
• Develop plans to replace unsupported, end-of-life equipment.

Joe Slowik, director of threat research at Dataminr, said operators should begin by assessing their internet-facing assets and reducing that exposure. They should then patch supported systems and evaluate upgrades for equipment that has reached the end of its service life.

The federal warning highlights how attacks against operational technology can produce physical consequences without stealing a single record. As refrigeration controllers become increasingly connected, weak passwords, exposed interfaces and outdated software can turn routine building equipment into a target capable of disrupting food supplies, medical services and critical operations.