United States government agencies have warned that cybercriminals are increasingly targeting industrial refrigeration and cold-chain monitoring systems across the world, potentially exposing businesses to equipment damage, fire hazards, service disruptions and significant inventory losses.
In a joint security advisory, the agencies disclosed that attackers could exploit vulnerabilities in unpatched or internet-connected refrigeration controllers to remotely manipulate operating settings, forcing cooling units into continuous heating or defrost cycles.
The warning was issued by the US Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Health and Human Services (HHS), Department of Agriculture (USDA) and Department of Transportation (DOT).
According to the agencies, attackers may exploit authentication bypass vulnerabilities, arbitrary code injection weaknesses and poorly secured configurations to gain unauthorised access to refrigeration systems.
Once inside, they could change temperature settings, potentially reducing the lifespan of equipment, creating fire risks and causing large-scale spoilage of temperature-sensitive products.
The agencies also warned that cyberattacks could disrupt monitoring systems, preventing operators from viewing accurate temperature readings and making it difficult to detect dangerous changes in storage conditions.
Such incidents could have serious consequences for consumers, particularly where food, medicines and other sensitive products are stored under unsafe conditions before being distributed.
To reduce the risks, organisations operating industrial refrigeration facilities have been advised to strengthen authentication, regularly install security updates and identify all refrigeration controllers and monitoring devices accessible through the internet.
Other recommended measures include isolating operational technology (OT) systems from less secure networks, replacing default passwords, retiring outdated equipment, disabling unnecessary remote access and properly securing remote connections that are essential for operations.
FBI Cyber Branch Operations Director Brett Leatherman said industrial refrigeration and cold-chain monitoring infrastructure plays a critical role in protecting food, medicines and other products that require controlled temperatures.
He warned that the systems have become attractive targets for malicious actors, with attacks increasingly affecting different critical infrastructure sectors worldwide.
Cyberattacks Hit Supermarkets Across Europe
The warning follows a series of cyberattacks targeting hundreds of supermarkets across Europe in recent weeks.
Attackers reportedly exploited weaknesses in refrigeration controllers exposed to the internet, manipulating temperature settings and forcing some cooling units into defrost mode.
In certain cases, temperatures were allegedly raised to as high as 50 degrees Celsius, resulting in spoiled food products and financial losses for affected businesses.
The targeted organisations reportedly included major supermarket chains, independent grocery stores and butcher shops across Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden and the United Kingdom.
The French Blood Establishment also confirmed a cybersecurity incident involving one of its refrigeration equipment providers.
According to the organisation, the incident caused temperature and defrost settings to be raised to extremely high levels at three facilities used for storing blood plasma.
The identity of those responsible for the wider wave of attacks remains unknown.
Hundreds of Refrigeration Controllers Remain Exposed
Security researchers have also identified hundreds of internet-accessible refrigeration management systems that could potentially be exposed to similar attacks.
Data from cybersecurity platform Censys showed that hundreds of Danfoss StoreView installations remained accessible online across different countries, with France accounting for the largest concentration.
However, the number of exposed installations declined significantly from 3,004 on October 9 to 708 on November 5, 2026.
Exposure involving Copeland/Dixell XWEB systems also decreased, falling from 3,708 to 2,420 during the same period.
Despite the reduction, researchers warned that thousands of industrial control systems remain exposed to potential cyber threats.
Censys described the refrigeration attacks as part of a broader pattern of cyber incidents targeting critical infrastructure, including fuel station tank monitoring systems, air raid warning infrastructure and water towers.
Industrial Control Systems Remain a Global Security Concern
Censys further highlighted the widespread exposure of industrial control systems (ICS), which are used to monitor and operate essential infrastructure across different industries.
According to the platform, North America accounts for approximately 38 per cent of globally exposed industrial control systems.
Asia’s share increased from 22 per cent in 2024 to 25 per cent in 2026, while Europe’s proportion declined from 36.5 per cent to 32 per cent.
However, researchers cautioned that the geographical changes have not translated into an overall reduction in exposure.
Censys noted that internet-facing industrial control systems have remained a longstanding cybersecurity concern despite years of warnings from security experts.
The latest refrigeration attacks demonstrate how weaknesses in operational technology can extend beyond conventional data breaches, creating physical risks to businesses, consumers and essential services.
Security agencies are therefore urging organisations responsible for critical infrastructure to strengthen their cyber defences, restrict unnecessary internet access and ensure that industrial equipment is properly secured against remote exploitation.