Five US Agencies Issue Joint Cybersecurity Warning for Refrigeration and Cold Chain Systems

Five US federal agencies — CISA, the FBI, HHS, USDA, and the Department of Transportation — published a joint fact sheet on November 5, 2026, warning operators of industrial refrigeration and cold chain monitoring systems about active cyber threats and recommending concrete protective measures.

Incidents that triggered the warning

The joint alert follows a series of cyber incidents affecting refrigeration systems in at least 11 European countries. In late October, hundreds of French supermarkets experienced disruptions when attackers remotely activated defrost cycles, pushing temperatures to nearly 125 °F (50 °C) and damaging stored inventories. Similar attacks were subsequently reported in other European countries, including incidents targeting blood banks. France's CERT-FR identified compromises involving Danfoss AK-SM and AK-SC controllers as well as Copeland and Dixell XWEB systems. Investigators have not yet established responsibility for the incidents or confirmed whether they constitute a single coordinated campaign. Separately, the US Department of Defense is investigating suspected cyberattacks linked to refrigeration failures at at least six military commissaries in August.

Attack vectors and potential consequences

According to the agencies, attackers may exploit authentication bypass vulnerabilities, arbitrary code injection, and weak configurations to alter controller settings remotely. Potential consequences include continuous heating or defrost cycles, inventory losses, equipment hazards, and loss of temperature monitoring visibility.

Recommended protective measures

The joint guidance recommends the following actions for operators:

• Remove controllers from direct internet exposure
• Separate operational technology (OT) networks from business networks
• Change default passwords and implement strong authentication
• Apply firmware updates and replace unsupported devices
• Maintain offline backups
• Review activity logs
• Establish safe temperature setpoint limits with alerts

Implications for distributors and contractors

For refrigeration distributors and contractors, the incidents underscore the need to communicate manufacturers' security guidance and provide technical training for internet-connected systems. Contractors can assist customers in identifying controllers, verifying remote access settings, and determining whether firmware updates are required. The federal guidance also recommends reporting suspicious activity to CISA or the FBI.

Source: Refindustry.