Five U.S. Agencies Warn of Cyberattacks Targeting Cold-Chain Refrigeration Systems

Five federal agencies published a joint fact sheet on November 5 warning operators of industrial refrigeration and cold-chain monitoring systems that malicious cyber actors are actively exploiting internet-exposed controllers to tamper with temperatures, spoil inventory, and damage equipment. The document, marked TLP:CLEAR and carrying no advisory number, is a government press release first, treat it that way, but the threat picture behind it is worth reading carefully.

According to the joint fact sheet reviewed directly from the CISA website, the authoring agencies are CISA, the FBI, the Department of Health and Human Services, the U.S. Department of Agriculture, and the Department of Transportation. That five-agency roster is itself a signal: this isn't a pure cyber story. It's a food safety, pharmaceutical cold chain, and public health story that happens to run on operational technology.

The fact sheet identifies three entry paths: authentication bypass, arbitrary code injection, and weak configurations on unpatched or internet-accessible controllers. Once inside, actors can force units into continuous heating and defrost cycles. Beyond spoiled goods, the agencies note equipment wear, fire risk, and consumer harm if improperly stored products reach the market. The document names no specific products, victims, or attributed threat actors, an attribution gap worth flagging, since the confidence level on who is running this campaign remains publicly unassessed.

The incident record underlying the advisory is clearer. According to reporting by SC World and SOCRadar, an estimated 250 to 350 French supermarkets were hit in October 2026, with refrigeration units forced into heating and defrost cycles. A second wave in November struck more than 115 stores across six European countries, with some units reportedly reaching 50 degrees Celsius. The France-specific detail that matters most for this beat: on November 3, the French Blood Establishment confirmed an incident at a refrigeration equipment provider that altered temperature and defrost settings at three blood product storage facilities. That's a healthcare supply-chain compromise with direct patient-safety implications, and it's the kind of case where the cyber incident and the biothreat portfolio overlap.

Published research has documented vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB Pro controllers, though as noted in Industrial Cyber's coverage, their confirmed exploitation in the reported attacks has not been established by the agencies. That gap matters. Decryption Digest identified CVE-2025-41450, a CVSS 8.2 authentication bypass in Danfoss AK-SM controllers, as a candidate entry point, but the government fact sheet declines to confirm specific products or CVEs.

FBI Cyber Branch Operations Director Brett Leatherman, quoted in the CISA press release, stated that the agencies are "seeing these systems targeted across critical infrastructure sectors globally." That's an operational claim, not an assessment, and it's consistent with the European incident timeline. What the government has not done is characterize the actor, the motive, or the scope of any U.S. incidents, except for a reference in SC World's coverage to reported freezer failures under investigation at U.S. military commissaries.

The mitigation list in the fact sheet is basic: pull controllers off the public internet, isolate OT from IT networks, change default credentials, apply available patches, enable phishing-resistant multifactor authentication where supported. These are not novel recommendations. The fact that they still need to be published in a five-agency advisory in 2026 is a structural story about how slowly OT security hygiene moves in sectors that weren't designed around network connectivity and are now deeply dependent on it.

The healthcare nexus is what elevates this above a standard OT advisory. Cold-chain integrity for blood products, vaccines, and biologics sits at the intersection of cyber operations and physical health outcomes. An actor who can alter temperature logs and hide the manipulation from operators, the technique described in both the fact sheet and secondary reporting, is not just causing spoilage. They're potentially introducing compromised products into a supply chain that depends on those logs for safety verification. That's the dual-use concern here, and the fact sheet doesn't use that framing. Operators and their regulators should.

Sources cited:
- CISA Joint Fact Sheet (TLP:CLEAR) (https://www.cisa.gov/sites/default/files/2026-11/joint-factsheet-usg-partners-urge-hardening-industrial-refrigeration-cold-chain-monitoring-systems-508c.pdf)
- CISA News Release, November 5, 2026 (https://www.cisa.gov/news-events/news/cisa-fbi-hhs-usda-and-dot-urge-critical-infrastructure-strengthen-industrial-refrigeration-and-cold)
- SC World (https://www.scworld.com/news/fbi-cisa-warn-of-cyberattacks-targeting-refrigeration-systems)
- SOCRadar (https://socradar.io/blog/refrigeration-cyberattack-fbi-cisa-warning/)
- Industrial Cyber (https://industrialcyber.co/industrial-cyber-attacks/cisa-federal-partners-flag-exposed-ot-controllers-as-cyberattacks-disrupt-supermarket-cooling-systems-across-europe/)
- Decryption Digest (https://www.decryptiondigest.com/blog/cold-chain-cyberattack-refrigeration-controllers-cisa-fbi)
- Cybersecurity News (https://cybersecuritynews.com/hackers-targeting-industrial-refrigeration-systems/)