Five United States government agencies have warned that hackers are breaking into internet-connected refrigeration systems at supermarkets, military bases and other facilities in at least a dozen countries, raising temperatures to spoil food and threaten safety. The joint advisory came from the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Departments of Agriculture, Health and Human Services, and Transportation on November 5.
What did the attackers actually do
According to the advisory, attackers compromised remote-controlled refrigeration and cold-chain monitoring systems and altered their settings, pushing temperatures up inside freezers and chillers. In some cases they forced units into continuous heating and defrost cycles instead of cooling. CISA’s acting cybersecurity chief, Chris Butera, said in the advisory that “every organization that depends on refrigeration and monitoring systems should assume it could be a target.”
The agencies said the intrusions hit remote-controlled units made by the Danish manufacturer Danfoss, some of which had stopped receiving security updates for certain customers. Supermarkets in a dozen countries reported spoiled food after their cold storage was tampered with.
Industrial refrigeration units like these are usually connected to the internet so a facility manager can monitor temperatures and adjust settings remotely, often from a phone app, without walking the warehouse floor. That same remote access is what let the attackers in. The advisory does not say how the attackers first gained entry to the Danfoss-run units, only that exploitation was “ongoing” as of the November 5 warning.
Who has been affected
The advisory names grocery and cold-storage operators, the food, agriculture and transportation sectors, and medicine-shipping cold chains as targets. Freezers at US military bases were also hit, and the advisory says the Pentagon is investigating. A blood bank in France was targeted as well, though officials said the attack was stopped before it reached the facility’s blood supply.
The agencies warned that tampering with refrigeration can cause fire hazards, spoiled inventory and shortened equipment life, beyond the immediate food-safety risk of a warehouse or supermarket losing its cold chain.
| Sector hit | What happened | Current status |
|---|---|---|
| Grocery and cold storage | Supermarket freezers and chillers in roughly a dozen countries had temperatures raised remotely, spoiling food | Advisory issued, patching recommended, no confirmed count of stores affected |
| US military bases | Base refrigeration units compromised | Pentagon investigation ongoing, no conclusion announced |
| Healthcare (France) | A blood bank’s refrigeration systems were targeted | Attack stopped before it reached the blood supply |
| Food, agriculture, transport and medicine shipping | Named by the advisory as sectors running at-risk cold-chain monitoring equipment | Advised to isolate remote-control systems from the open internet |
Who officials think is behind it
The joint advisory does not formally attribute the intrusions to any government or group. Independent security researchers have broadly linked the activity to Iran, and US officials have reportedly told reporters they suspect an Iranian connection, but no agency has made that attribution on the record.
What the advisory tells operators to do
CISA and its partner agencies recommend taking remote-control systems off the open internet entirely, replacing default or weak passwords, applying vendor patches where they are still available, and retiring equipment that no longer receives security updates. A separate fact sheet from CISA details how attackers can force units into abnormal heating or defrost cycles even without full administrative access.
The advisory frames refrigeration and cold-chain monitoring as critical infrastructure in its own right, alongside better-known targets like power grids and water systems, a category the agencies say has drawn too little security attention until now.
Frequently asked questions
Is any specific supermarket chain or brand named in the advisory?
No. CISA’s advisory describes the pattern of attacks and the vulnerable Danfoss-run equipment without naming individual retailers or operators affected.
Does this affect home refrigerators or freezers?
No. The advisory is specifically about industrial, remote-controlled refrigeration and cold-chain monitoring systems used by businesses, not consumer appliances.
Has any government been formally blamed for the attacks?
No. The joint advisory does not attribute the campaign to any specific country or group. Independent researchers have pointed to Iran, and US officials have reportedly said they suspect an Iranian link, but that has not been stated on the record by any agency.
What to watch next
The Pentagon’s investigation into the military base intrusions has not been concluded, and no government has formally named a state actor behind the campaign. Whether affected supermarket chains and cold-chain operators act on the advisory’s patching and network-isolation recommendations before the next attempt will determine how much further this spreads.
Leave a Reply