Federal agencies say vulnerable refrigeration controls could be manipulated remotely, threatening food, medicine, equipment and other temperature-sensitive supplies.
WASHINGTON, DC — U.S. cybersecurity and law enforcement agencies are warning businesses and critical infrastructure operators about an ongoing cyber threat targeting industrial refrigerators, freezers and cold-chain monitoring systems, where attackers can potentially change temperatures and disrupt equipment remotely.
The Cybersecurity and Infrastructure Security Agency, FBI and the departments of Health and Human Services, Agriculture and Transportation issued joint guidance Nov. 5 after malicious cyber activity was reported against refrigeration systems around the world. Officials said attackers are targeting electronic temperature controllers and commercial refrigeration systems, particularly equipment that remains exposed to the internet or has not received available security updates.
The warning matters because industrial refrigeration is used far beyond supermarkets. Hospitals, medical laboratories, blood services, food producers, warehouses, chemical facilities and transportation companies depend on tightly controlled temperatures. A successful intrusion could spoil inventory, damage equipment or create unsafe storage conditions. Federal officials also warned that malicious changes to refrigeration controls could contribute to fire hazards or shorten the operating life of equipment.
Many modern refrigeration systems use electronic controllers that allow workers or contractors to monitor temperatures, manage defrost cycles and adjust equipment remotely. That connectivity can improve efficiency, but it also creates a path for attackers when control systems are exposed directly to the public internet, use weak configurations or remain vulnerable to known software flaws. Federal agencies said attackers have exploited weaknesses in such systems to alter operating settings.
Authorities warned that hackers could force refrigeration equipment into repeated heating or defrost cycles, causing temperatures to rise when products are supposed to remain cold. Attackers may also interfere with temperature monitoring, making it harder for operators to recognize that conditions have changed. Those risks are especially serious for facilities storing medicine, blood products, food or other goods that can become unusable if temperatures move outside safe limits.
The federal alert follows a series of incidents involving refrigeration equipment in Europe. Grocery retailers in several countries have reported unexpected temperature changes that forced stores to discard food. French authorities also reported a cyber incident involving refrigeration equipment serving three blood-service facilities. Alerting systems detected the problem before stored blood products were compromised, according to accounts of the incident cited by U.S. authorities and cybersecurity reporting.
Questions also remain about refrigeration failures at U.S. military installations. Refrigeration units at about six military commissaries experienced problems beginning in August, and federal investigators have been examining whether the incidents resulted from cyberattacks. The Army Criminal Investigation Division has been involved in the investigation. Officials have not publicly established that those failures were connected to the attacks reported overseas.
The U.S. government has not publicly attributed the broader refrigeration attacks to a particular hacking group or foreign government. Some reports have cited suspicions involving Iran-linked actors, but the joint federal warning does not identify an attacker. The government instead focused its notice on the continuing technical risk and the widespread use of refrigeration controllers across critical infrastructure.
Federal officials said organizations should identify refrigeration controllers that can be reached from the internet and remove unnecessary public access. The agencies also recommended replacing default passwords, applying available software and firmware updates, protecting necessary remote connections with stronger authentication and separating operational technology from ordinary business networks. Unsupported equipment that can no longer receive security updates may present additional risk.
The warning highlights a broader cybersecurity concern involving operational technology, the computerized equipment that directly controls physical processes. Unlike a conventional data breach, an intrusion into such systems can affect machinery and real-world conditions. In the case of refrigeration, manipulating a digital controller could translate into spoiled food, damaged equipment or unsafe temperatures for products that require continuous cooling.
CISA said organizations that depend on refrigeration and monitoring systems should treat themselves as potential targets while the malicious activity continues. Federal agencies are tracking the threat with industry and international partners, while investigations into recent incidents remain underway and the identity of the attackers has not been officially established.
Author note: Last updated November 6, 2026.