The US government has urged organizations to take action to protect refrigeration systems from attacks that seek to remotely alter settings, including temperatures.

The advisory, issued by the Cybersecurity and Infrastructure Security Agency (CISA), the FBI and other federal agencies, said that US authorities “are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally.”

The warning follows a number of recent incidents in which hackers accessed internet-connected refrigeration systems and have attempted to tamper with temperatures.

Such attacks can have had huge real-world impacts, including ruining food and medical supplies.

On October 11, 2026, it was reported that several supermarket chains in France and other countries in Europe were forced to destroy food stock after hackers compromised systems administered by refrigeration systems provider Danfoss. The attackers reportedly programmed systems to reach temperatures as high as 50 °C (122°F).

A similar incident occurred on November 1, with supermarkets in at least nine European countries reportedly impacted.

Most recently, a cyber-attack targeting refrigeration equipment provider Coolworld saw cold storage rooms in France's National Blood Service (EFS) turned to a boiling temperature of 110°C (230°F).

The US advisory, published on November 5, warned operators and owners of refrigeration systems in the US to be vigilant for similar attacks.

This is particularly in sectors such as healthcare, chemical, food and agriculture, and transportation, which widely use these systems for automated and remote monitoring of temperatures, continuous temperature logging, defrost cycle management and energy optimization.

“The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards,” the authoring agencies wrote.

They noted that hackers can use techniques like authentication bypass, arbitrary code injection and weak configurations to gain remote access to these internet-exposed systems.

Urgent Action Required to Protect Refrigeration Systems

The authoring agencies set out a number of immediate actions security teams should take to mitigate risks to industrial refrigeration and cold chain monitoring systems, based on the recent threats observed. These include:

• Ensure control system devices, particularly controller panels are not exposed to the internet
• Should remote access be necessary, protect these systems using a firewall or edge device and update them to the latest version to reduce security vulnerabilities
• Isolate operational technology devices from business networks
• Change default passwords and implement strong authentication policies, including phishing-resistant multi-factor authentication (MFA)
• Establish a structured lifecycle management process to identify, retire and replace legacy devices that are end of life
• Limit access to only those devices and IP addresses authorized to make changes
• Maintain backup systems offsite and offline and regularly test them

CISA’s acting executive assistant director for cybersecurity Chris Butera, commented: “Every organization that depends on refrigeration and monitoring systems should assume it could be a target. We urge you to review the joint fact sheet and take action now to close known security gaps.”

Refrigeration Systems Taken Offline Following Europe Incidents

Data published by Censys on November 5 revealed there has been a 53% reduction in internet-exposed refrigeration controllers across the Danfoss StoreView and Copeland/Dixell XWEB products that were compromised during the supermarket incidents on October 11 and November 2, respectively.

The big fall in exposure is consistent with provider action or owners disconnecting devices, Censys noted.

So far, the incidents have not been attributed to a particular threat actor.