U.S. agencies warn that hackers keep targeting industrial freezer controllers, after attacks on European supermarkets and a French blood-storage site, outlets report

Federal agencies issued a joint warning on Thursday, Nov. 5, that hackers keep targeting the industrial refrigeration and cold-chain monitoring systems that hold food, medicine and other temperature-sensitive goods. The advisory carries the names of CISA, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation, and carries a TLP:CLEAR marking, which permits unrestricted distribution. TechCrunch reported the warning as an “ongoing cyber threat,” and BleepingComputer, The Register and Politico (through a search excerpt only) reported it the same day.

The advisory describes the threat in plain terms. It says the agencies know of malicious actors who target electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities, and who may exploit flaws in unpatched or internet-accessible controllers to change settings remotely. According to the advisory, such flaws include authentication bypass, arbitrary code injection and weak configurations, and a successful intruder could alter temperatures, shorten the equipment’s service life, create a fire hazard, cause inventory loss, or indirectly harm consumers who eat food stored unsafely. The advisory adds that an attacker could also leave operators unable to see current temperatures.

The agencies framed the risk for a broad audience. TechCrunch quoted the statement as saying: “If successfully exploited, the actors could change the temperature and possibly cause physical impacts such as fire hazards, loss of inventory and changes to the service life of the system.” BleepingComputer quoted Chris Butera, CISA’s acting executive assistant director for cybersecurity: “Every organization that depends on refrigeration and monitoring systems should assume it could be a target.” The Register quoted Brett Leatherman, the FBI Cyber Branch’s operations director: “We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk.”

The warning follows attacks in Europe that outlets have tracked for weeks. BleepingComputer wrote that in October hackers compromised controllers at an estimated 250 to 350 French supermarkets and remotely switched on defrost functions, and that a second wave, reported in November, hit more than 115 stores in six European countries, with some systems shutting down and others heating up to 50°C. The Register wrote that unknown actors have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg and Sweden since mid-October. TechCrunch wrote that some affected units came from the Danish company Danfoss, which had stopped providing security updates for them. Earlier coverage on this site, in a Nov. 2 story, described the second wave’s first reports.

The most worrying incident involved blood. BleepingComputer wrote that on Nov. 3 the French Blood Establishment (EFS) confirmed a cybersecurity incident affecting a refrigeration equipment provider, and that the incident altered temperature and defrost settings at three facilities that store blood products. TechCrunch wrote that hackers raised temperatures in cold units that held donated blood, but that hackers got stopped before they compromised the blood supplies. This desk found no statement from EFS in the pages it read, so it relies on those two outlets for the account.

The U.S. side of the story remains less clear. TechCrunch wrote that the Defense Department investigates hacks of freezers that military bases run, citing Reuters; The Register wrote that the Pentagon reportedly treats freezer malfunctions that spoiled food at military bases in August as a suspected cyberattack, also citing Reuters. The Politico excerpt this desk read says the Pentagon said in a statement last week that it investigates freezer malfunctions at six commissaries on U.S. bases, though the excerpt calls the link to the other incidents unclear. The Register wrote that it asked the FBI whether the bureau had documented any attack on American refrigeration systems, that it had no reply by publication, and that it knew of no documented digital attack on an American supermarket.

On who stands behind the attacks, the outlets agree that no official blame has landed. TechCrunch wrote that the U.S. has not attributed the hacks to any group or government, that security researchers broadly attribute them to Iran, and that U.S. officials also reportedly suspect Iran. The advisory itself names no actor. This desk read no technical report that would let it test the Iran attribution, and it treats the attribution as unverified.

The advisory asks owners and operators to act at once. Its mitigations include keeping control devices and controller panels off the public internet, protecting any necessary remote access with an updated firewall or edge device, separating operational technology from business networks with a dedicated virtual LAN, replacing default passwords and adopting phishing-resistant multifactor authentication where feasible, and patching firmware. It also calls for retiring equipment that the manufacturer no longer supports, limiting access through allowlists, keeping tested offline backups, turning on and reviewing logs, and setting safe temperature limits that trigger alerts when readings drift.

This desk read the TechCrunch, BleepingComputer and Register pages and the advisory PDF as saved copies, and the Politico story only through a search excerpt because its page blocked this desk’s fetch. It read no EFS statement, no Reuters story, and no vendor advisory. The sources also differ on scale: TechCrunch wrote of at least a dozen countries, BleepingComputer of six countries in the second wave, and The Register of five named countries; the desk does not choose between them. Times convert to Pacific Time (UTC−8).