US Government Issues Urgent Advisory on Cyber Threats to Industrial Refrigeration and Cold Storage Systems

On November 5, 2026, the Cybersecurity and Infrastructure Security Agency (CISA), FBI, and partner agencies including HHS, USDA, and DOT released a joint fact sheet warning of ongoing malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems worldwide. These controllers, used across healthcare, food and agriculture, chemical, and transportation sectors, are being exploited through unpatched vulnerabilities, internet exposure, and weak credentials, potentially allowing attackers to alter temperatures, force defrost or heating cycles, and cause inventory spoilage, equipment damage, or fire hazards.

CISA Acting Executive Assistant Director Chris Butera stated that every organization relying on such systems should assume it is a target and urged immediate review of mitigations. FBI Cyber Branch Operations Director Brett Leatherman noted the systems' global targeting due to their role in protecting temperature-sensitive goods like food and medicine.

The advisory follows documented waves of attacks in Europe. In October 2026, hundreds of French supermarkets (estimates range from 250-700 stores) saw refrigeration units forced into defrost mode, leading to tens of millions of euros in losses. A subsequent wave on or around November 1-2, 2026, impacted supermarkets in Belgium (dozens of Delhaize, Carrefour, and others), Ireland (13 SuperValu stores), Sweden (ICA and Coop), and additional countries including Luxembourg, Estonia, and the Netherlands, with temperatures reportedly reaching 50°C (122°F) in some cases. A separate incident targeted France's public blood service (EFS) via provider Coolworld, though monitoring systems prevented product loss.

Recommended actions include removing systems from the public internet, changing default passwords, applying patches, retiring legacy devices, and securing remote access. Official sources emphasize these are not attributed to specific actors but represent a persistent threat to critical infrastructure.