CISA, FBI warn refrigeration systems are under active cyberattack
Six military commissaries, three French blood banks, and supermarket chains across Europe have already been hit, and the joint alert stops short of naming Iran, which U.S. officials suspect.
TL;DR
CISA, the FBI, and the departments of Health and Human Services, Agriculture, and Transportation issued joint guidance Thursday warning that hackers are targeting electronic temperature controls on refrigeration systems at grocery stores, cold storage facilities, and other critical-infrastructure nodes worldwide. The notice follows freezer malfunctions at roughly six U.S. military commissaries that began around late August, incidents U.S. officials suspect are tied to Iran-linked hackers, and attacks on blood banks in France and supermarkets in Sweden, Belgium, and Luxembourg this week. The agencies warned that attackers could force units into continuous heating or defrost cycles and suppress temperature readouts, risking spoiled inventory, equipment damage, and fire hazards. The alert does not name an attacker.
The joint advisory lands on a threat that's been unfolding in plain sight for weeks, and it lands with an unusual signatory list. Agriculture and Transportation sitting alongside CISA, the FBI, and HHS signals that federal concern reaches beyond the commissary incidents into cold-chain logistics and food supply broadly. That's the operational shape of the warning: refrigeration isn't a niche building-management problem anymore. It's a critical-infrastructure surface, and the attacks are crossing sectors and borders.
The known timeline makes the case. Roughly six commissaries at U.S. military bases suffered freezer malfunctions starting around late August. At Fort Huachuca in Arizona, a freezer entered defrost mode and heated its contents. U.S. officials told Nextgov/FCW they suspect Iran-linked hackers, though the joint alert itself declines to name any actor. In October, attackers overrode temperature controls at hundreds of French supermarkets, forcing retailers to discard spoiled food. Overnight Sunday into Monday this week, hackers hit refrigeration systems at three regional blood banks in France. Then a new wave struck supermarkets in Sweden, Belgium, and Luxembourg, raising fridge temperatures and triggering food disposal.
The agencies laid out what the attacker can do once inside: force refrigerators and freezers into continuous heating or defrost cycles, and prevent operators from seeing current temperature readings. The second piece matters, suppressed readouts mean the operator can't tell whether inventory is safe, even if the cooling hasn't failed yet. That's a confidence attack on the monitoring layer, not just a physical one on the equipment.
The mitigations themselves are fundamentals that CISA has been pushing since at least the May 2024 pro-Russia hacktivist advisory on OT and ICS: remove control systems from the public internet, segment refrigeration controls from business networks, replace default passwords, apply security updates, and retire unsupported equipment. Chris Butera, CISA's acting executive assistant director for cybersecurity, framed it bluntly: "Every organization that depends on refrigeration and monitoring systems should assume it could be a target." Brett Leatherman, the FBI's cyber branch operations director, added that the bureau is "seeing these systems targeted across critical infrastructure sectors globally."
The alert does not say whether the recommended internet-isolation and segmentation steps address the specific access vectors used in the commissary incidents, nor whether investigators have identified a zero-day or simply found unpatched, exposed devices. Nahman Khayet, co-founder and CEO at Alt Security, pointed to the practical problem: refrigeration units are massive, costly to replace, and downtime is prohibitive, meaning security updates that require taking a unit offline often don't happen. That's the same dynamic Iranian operators have exploited against other OT targets for years.
European authorities issued their own joint warning Wednesday through the European Commission, ENISA, and Europol, coordinating response and sharing information about the incidents. The U.S. alert is part of that broader transatlantic response.
For contractors supplying military commissaries, base hospitals, and cold-chain logistics: this is a supply-chain notice as much as an OT advisory. If your refrigeration controls sit on the public internet, the assumption should be that they're already being scanned.
Published ·Deep Fathom