Global Authorities Issue Urgent Warning as Hackers Target Industrial Refrigeration and Cold-Chain Systems

U.S. government agencies have issued an urgent global warning regarding a sophisticated campaign by malicious threat actors actively targeting industrial refrigeration and cold-chain monitoring systems. The attacks are designed to cause widespread service disruptions, severe fire hazards, and massive inventory losses across critical infrastructure sectors worldwide, posing a direct threat to public safety, food security, and public health supply chains.

According to a joint cybersecurity advisory issued by a coalition of federal authorities—including the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), the Department of Agriculture (USDA), and the Department of Transportation (DOT)—these threat actors are systematically exploiting vulnerabilities and weaknesses in unpatched or internet-accessible industrial controllers. By remotely altering operational settings, attackers can force refrigeration units into continuous heating and defrost cycles. This malicious manipulation can rapidly spoil sensitive inventories and create dangerous equipment malfunctions.

The joint advisory highlights that threat actors are leveraging multiple attack vectors, including authentication bypasses, arbitrary code injection, and weak system configurations, to infiltrate these critical operational technology environments. Once inside, they can manipulate temperature controls to catastrophic effect. In response to the escalating threat, owners and operators of industrial refrigeration and cold-chain infrastructure are being urged to implement stringent defensive measures. These include enforcing strong multi-factor authentication, applying regular firmware and software patches, identifying and disconnecting any systems improperly exposed to the internet, and isolating operational technology networks from corporate IT networks. Additional recommendations involve changing default credentials, retiring obsolete legacy devices, removing unnecessary remote access pathways, and rigorously securing any remote access channels that remain operationally necessary.

Brett Leatherman, the FBI Cyber Branch Operations Director, emphasized the severity of the threat in a public statement. "Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors," Leatherman said. "We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk."

This international warning follows a troubling wave of real-world cyberattacks observed in recent weeks across Europe. Threat actors have targeted hundreds of supermarkets and grocery stores by exploiting security weaknesses in internet-accessible refrigeration controllers. In these incidents, attackers raised internal storage temperatures—in some instances soaring as high as 50 degrees Celsius, or 122 degrees Fahrenheit—or forced cooling systems into aggressive defrost modes. These actions resulted in the widespread spoilage of perishable food items and inflicted significant financial damage on businesses ranging from major supermarket conglomerates to independent local grocers and butchers.

The geographic scope of these intrusions has been extensive, affecting facilities across Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the United Kingdom. Among the most alarming targets was the French Blood Establishment (EFS), which officially confirmed that a cybersecurity incident impacting one of its third-party refrigeration equipment providers had elevated temperature and defrost settings to extremely high levels across three critical facilities dedicated to storing blood plasma. While investigations continue, authorities have not yet publicly attributed the hacking spree to a specific state-sponsored group or cybercriminal syndicate.

Data collected by attack surface management platform Censys sheds light on the vast digital exposure that has enabled these campaigns. Research shows that hundreds of Danfoss StoreView instances remain exposed to the public internet globally, with the highest concentration located in France. Although coordinated mitigation efforts have driven a notable decline in exposure—with Danfoss StoreView instances dropping from 3,004 to 708 between October 9 and November 5, 2026, and Copeland/Dixell XWEB exposures falling from 3,708 to 2,420—the remaining surface area continues to represent a significant security liability.

Censys researchers noted that these refrigeration-focused cyberattacks represent only the latest chapter in an ongoing series of incidents aimed at vulnerable components of critical infrastructure. Previous campaigns have targeted similar internet-connected operational assets, including gas station tank gauges, public warning and air raid systems, and municipal water towers.

Furthermore, global exposure statistics illustrate that industrial control systems remain persistently vulnerable across multiple continents. Censys data indicates that North America currently accounts for approximately 38 percent of global industrial control system exposure. Meanwhile, Asia’s share of exposure grew from 22 percent in 2024 to 25 percent in 2026, while Europe’s share saw a slight decrease from 36.5 percent to 32 percent over the same period. Despite minor regional shifts, the overall volume of exposed infrastructure has not experienced a meaningful decline.

Security analysts emphasize that while these high exposure figures are alarming, they are largely reflective of long-standing systemic vulnerabilities that cybersecurity experts have warned about for years. Because these industrial control systems act as foundational gatekeepers to the world’s most vital supply chains and critical infrastructure networks, their continued exposure poses an unacceptable and critical risk to public safety and economic stability on a global scale.