US Agencies Warn of Ongoing Hacks on Industrial Refrigeration After Attacks in Europe

The joint statement came from the Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the Departments of Agriculture, Health and Human Services, and Transportation. It said unidentified "malicious cyber actors" are exploiting electronic temperature controllers and commercial refrigeration controllers that are unpatched or reachable from the internet in retail grocery and cold storage facilities. The agencies said the activity reaches into food and agriculture, transportation and the shipping of medicines.

The risk is physical as well as digital. "If successfully exploited, the actors could change the temperature and possibly cause physical impacts such as fire hazards, loss of inventory and changes to the service life of the system," the agencies warned. In a separate fact sheet, they said hackers may try to "force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards."

Chris Butera, CISA's acting executive assistant director for cybersecurity, said: "Every organization that depends on refrigeration and monitoring systems should assume it could be a target."

A Campaign That Began in Europe

The US warning follows weeks of attacks on store refrigeration across Europe. TechCrunch reported two separate waves of attacks that let hackers raise temperatures on freezers and chillers in at least a dozen countries, spoiling thawed food and destroying produce. According to TechCrunch, some of the affected units were remote-controlled systems made by the Danish manufacturer Danfoss, which had stopped issuing security updates for them. Attackers also targeted a blood bank in France, raising temperatures in units holding donated blood before they were stopped.

In an assessment published on November 3, researchers at the security company SentinelOne traced attacks on hundreds of French supermarkets between October 11 and 13. They also described a second cluster on November 2 and 3 that hit stores in countries including Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia. The report cites France's economy minister, Roland Lescure, as putting the number of affected French stores at about 700. It also says France's cyber agency, ANSSI, linked the French cases to exposed administration interfaces and weak passwords, not to software flaws that had already been published.

Military sites have been affected too. Reuters reported that the US Department of Defense is investigating a series of hacks on freezers run by the military. SentinelOne's timeline attributes freezer failures at six or more US military commissaries in late August and early September to suspected hacking.

Who Is Behind It

The US statement did not name any group or government. TechCrunch said security researchers have broadly attributed the attacks to Iran and that US officials reportedly see Iran as the likely culprit. SentinelOne was more cautious. It said attribution for the European incidents has not been publicly established, called Russian-aligned groups a credible hypothesis based on past attacks, and said suspicion of Iran-linked actors applies only to the US commissary cases and remains provisional.

Offline Controllers and New Passwords

The agencies urged operators to remove remote control systems from the internet, change and strengthen passwords, apply patches where they can and retire equipment the vendor no longer supports. SentinelOne also advised operators to limit remote access to secure VPNs and to keep logs before resetting compromised controllers. It called third-party maintenance access an important lead for investigators, though it said this has not been confirmed as a common route in. The researchers expect more incidents wherever the same access conditions persist.