U.S. Agencies Warn Hackers Are Still Targeting Industrial Refrigeration and Cold Chain Systems

U.S. federal agencies warned on 5 November 2026 that hackers are continuing to target internet-connected industrial refrigeration and cold chain monitoring systems in grocery stores and cold storage facilities. The joint statement came from CISA, the FBI, and the Departments of Agriculture, Health and Human Services, and Transportation. TechCrunch reported the warning alongside the wider wave of intrusions behind it.

Two waves of cyberattacks have raised temperatures on freezers and chilling units in at least a dozen countries. The result has been spoiled defrosted food and destroyed produce. The agencies said the affected sectors include food, agriculture, transportation, and medicine shipping, all of which are classed as critical infrastructure.

The agencies said successful exploitation could allow an attacker to change temperatures. The consequences they listed were fire hazards, loss of inventory, and changes to the service life of equipment. They also warned that hackers may force units into continuous heating and defrost cycles, which could cause widespread inventory loss and equipment hazards. The joint guidance, published by CISA, addresses operators of these systems directly.

Some of the affected systems were remote-controlled units made by Danish manufacturer Danfoss that had stopped receiving security updates. That detail puts the vendor support lifecycle (the period during which a manufacturer issues security fixes) at the center of the exposure. Equipment that falls off a patch schedule stays on the network, and its remote management interface stays reachable.

In France, hackers targeted a blood bank and raised temperatures in cold units holding donated blood. The intrusion was stopped before the blood stores were compromised. The EFS confirmed the incident and said it involved one of its refrigeration equipment service providers.

The U.S. Department of Defense is investigating hacks targeting freezers run by the military. Reuters reported in late October that the Pentagon was treating freezer malfunctions on U.S. military bases as a suspected cyberattack.

On attribution, the U.S. government has not tied the freezer hacks to a particular group or government. Security researchers have broadly attributed the refrigerator attacks to Iran. U.S. officials have reportedly suspected Iran as the likely culprit behind the attacks on military base freezers. Those are separate claims from separate parties.

The agencies urged affected industries to take several steps. Remote control systems should be removed from the internet. Passwords should be strengthened and patches applied. Equipment that the vendor no longer supports should be retired. Chris Butera, acting cybersecurity chief at CISA, said that every organization depending on refrigeration and monitoring systems should assume it could be a target.

The broader context here is an old problem in a new setting. Cold chain monitoring and control were built to be reachable, because operators wanted to check a compressor's status or adjust a setpoint (the target temperature the unit holds) from a phone or a central office. That convenience made the devices useful. It also put them on networks where an attacker with a stolen credential or an unpatched flaw can reach them. Industrial control gear often runs for many years, and its owners may not track when support ends.

In my view, the lesson for practitioners is less about exotic exploitation than about inventory and exposure. Operators who cannot list every networked refrigeration controller, its firmware version (the software built into the device), and its support status are not in a position to assess the risk.

The remedies the agencies list are mostly mundane: network segmentation (separating control systems from the wider network), credential hygiene, patch management, and retirement of unsupported hardware. They are also within reach. Outbound-only telemetry, where devices send data out but accept no inbound remote commands, is one architectural option that fits the spirit of the guidance. It would let a grocery chain or blood bank keep watching its cold rooms without leaving the controllers open to the internet. The cold chain is a quiet system that most people never think about until a freezer fails. Keeping it quiet for the right reasons is a problem the industry can solve with work it already knows how to do.