From supermarket freezers to blood plasma stores, attackers are targeting refrigeration controllers exposed to the internet, putting food, medicine and equipment at risk
The systems that keep food and medicine cold are now a target for cyber attackers, according to a joint warning from US government agencies. The advisory says threat actors are actively going after industrial refrigeration and cold-chain monitoring systems worldwide, with the aim of causing service disruption, fire hazards and inventory loss.
The warning comes from the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), the Department of Agriculture (USDA) and the Department of Transportation (DOT). “The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards,” the advisory states.
How the attacks work
The agencies say attackers are likely to exploit authentication bypasses, arbitrary code injection and weak configurations to gain access. Once inside, they can change temperatures, which can shorten the service life of the system, create a fire hazard, destroy stock or harm consumers who later buy products stored unsafely. They can also knock out monitoring through a denial-of-service attack, leaving operators with no view of current temperatures.
Why refrigeration is attractive
“Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” said FBI Cyber Branch Operations Director Brett Leatherman.
“We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk.”
The damage in Europe
The threat is already playing out. In recent weeks, attackers have targeted hundreds of supermarkets across Europe by exploiting weaknesses in refrigeration controllers reachable from the internet. They raised temperatures, in some cases as high as 50 degrees Celsius (122 degrees Fahrenheit), or forced cooling units into defrost mode, spoiling food and causing financial losses. Targets ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden.
The French Blood Establishment was also affected. It confirmed that a cybersecurity incident at a refrigeration equipment provider had pushed temperature and defrost settings to “extremely high levels” at three facilities used to store blood plasma. Who is behind the hacking spree remains unclear.
Exposure is falling, but not fast enough
Data from Censys shows hundreds of Danfoss StoreView instances are still exposed worldwide, most of them in France. The number has fallen sharply, however, from 3,004 to 708 between October 9 and November 5, 2026. Exposure of Copeland/Dixell XWEB devices has also declined, from 3,708 to 2,420.
The attack surface management platform places the refrigeration attacks in a longer pattern of recent incidents targeting critical infrastructure, including gas station tank gauges, air raid systems and water towers.
Censys says that, while the regional balance has shifted, the overall problem has not eased. “North America accounts for roughly 38% of global ICS [industrial control systems] exposure,” it said. “Asia’s share grew from 22% in 2024 to 25% in 2026, while Europe’s fell from 36.5% to 32%. However, these shifts have not produced an overall decline.”
“While exposure numbers are high, they’re hardly surprising: ICS exposure is a problem that’s been reported on and warned about for years. It poses a critical risk to the public as gatekeepers to the world’s critical infrastructure.”