CISA and FBI Tell Every Cold-Storage Operator to Assume It Is a Target as Freezer Hacks Continue

Since the first wave of European supermarket freezer attacks in October, the story has been about spoiled food and blood-bank scares overseas. Today, Nov. 5, Washington put its name on the warning. CISA, the FBI and the Departments of Health and Human Services, Agriculture and Transportation issued a joint statement calling the activity an "ongoing cyber threat" to industrial refrigeration.

The statement says unidentified "malicious cyber actors" are targeting vulnerabilities in internet-accessible electronic temperature and refrigeration controllers at retail grocery and cold-storage facilities.

It names no group and no government.

What the agencies say can happen

The agencies warned that attackers could change temperatures and cause "fire hazards, loss of inventory and changes to the service life of the system." They said hackers may force units into continuous heating and defrost cycles. Attackers could also keep operators from seeing current temperatures, which makes problems harder to catch.

The advisory also flags harm to consumers who use products kept at unsafe temperatures. It points to hospitals, pharmaceutical suppliers, chemical companies and transportation providers as users of the same kind of systems.

"Every organization that depends on refrigeration and monitoring systems should assume it could be a target," said Chris Butera, CISA's acting executive assistant director for cybersecurity.

Brett Leatherman, the FBI's cyber branch operations director, said: "We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk."

The fixes are basic

The instructions are not exotic. Pull control systems off the public internet. Secure any remote access that is still needed. Separate refrigeration controls from business networks. Replace default passwords, apply patches, and retire equipment the vendor no longer supports.

According to TechCrunch's reporting, some of the affected units were remote-controlled Danfoss refrigeration systems for which the company had stopped providing security updates.

Much of this exposure is a matter of devices reachable from the open internet with weak credentials or no support. Owners can fix that without waiting for Congress or a new agency program.

The military angle

Freezers and refrigeration units at several U.S. military commissaries unexpectedly switched into defrost or heating modes starting around late August. Nextgov/FCW reported last week that roughly six commissaries were affected and that U.S. officials suspect Iran-linked hackers. Reuters first reported that the Pentagon is treating the incidents as possible cyberattacks.

The Defense Department's inspector general, among others, is investigating. The federal notice issued today does not say whether the commissary failures are tied to the European attacks. The Record notes it is unclear whether the August malfunctions are connected to the recent wave.

The timeline is simple. The first military incidents date to late August. The public federal warning to industry came about ten weeks later, after hundreds of French establishments were hit in October and more than 100 stores across Europe were hit on Monday, Nov. 2, according to Reuters.

Who is behind it

No one has claimed responsibility. Security researchers have broadly pointed to Iran, TechCrunch reports, and U.S. officials reportedly suspect Iran. Washington has made no formal attribution.

European authorities have been looking in a different direction. The Record reports they are on high alert for hybrid threats to infrastructure amid tensions with Russia following its invasion of Ukraine. The Kremlin has repeatedly denied involvement in any hybrid warfare or sabotage operations.

Those two lines of suspicion have not been reconciled in any official statement.

Damage so far

A sweeping hack of French freezers in October caused tens of millions of euros in damage, according to Reuters. Stores in Sweden, Belgium and Luxembourg were hit in this week's wave, forcing retailers to discard food, Nextgov reports.

In France, hackers also tampered with cooling controls at three regional blood banks overnight Sunday into Monday, the French Blood Establishment announced. TechCrunch reports the blood supplies themselves were not compromised. The Record says it is unclear whether those incidents are linked to the supermarket attacks.

What to watch

The open questions are specific. Will the Pentagon inspector general or the FBI publicly tie the August commissary failures to the European attacks? Will Washington formally name a state or group? The advisory leaves both unanswered, and it asks operators to act regardless.