home

FBI and CISA Warn Hackers Are Targeting U.S. Grocery and Cold-Storage Refrigeration After Attacks in Europe

RAGE Global · U.S. · Cyber · Developing · 7 min read

By Carlos KfouryPublished

Slide 01 of 05

  1. Cyber alert, 9 November 2026. Illustration: the seal of the Federal Bureau of Investigation over a dark blue wall of data screens. Official, FBI-CISA joint advisory. Headline: "FBI: hackers are targeting U.S. freezers." Five federal agencies warn of an "ongoing cyber threat" to grocery and cold-storage refrigeration after waves of attacks in Europe. Sources: FBI, CISA, Reuters via CNBC.

Published on Instagram with this story · swipe or use the arrow keys

Five U.S. federal agencies warned on Thursday 5 November 2026 of an "ongoing cyber threat" to industrial refrigeration and cold-chain monitoring systems, after waves of attacks on supermarkets and a blood service in Europe. The FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services (HHS), the Department of Agriculture (USDA) and the Department of Transportation (DOT) issued a joint fact sheet saying "malicious cyber actors" are targeting internet-reachable temperature and refrigeration controllers in grocery stores and cold-storage facilities. The warning names no culprit, and the agencies did not say whether any U.S. refrigeration system has been hit. On Monday 9 November France blamed a unit linked to Iran's Revolutionary Guards for its own October attack.

Key takeaways

  • Official: the FBI, CISA, HHS, USDA and DOT jointly warned on 5 November of an "ongoing cyber threat" to refrigeration and cold-chain controllers. The risks they list include inventory loss and fire.
  • How attackers get in: controllers that are reachable from the internet, unpatched or poorly configured. Reported flaws include authentication bypass and arbitrary code injection.
  • What the agencies advise: take controllers off the public internet, separate them from other networks, replace default passwords and apply updates.
  • No culprit named: the U.S. fact sheet blames unidentified actors. France has attributed only its own October attack, to an IRGC-linked unit.
  • Not confirmed: any successful attack on a civilian U.S. refrigeration system. The Pentagon is treating freezer failures at U.S. military commissaries in August as a suspected cyberattack.

Confidence: OFFICIAL for the fact that the warning was issued and for what it advises; REPORTED for the technical details, which RAGE X takes from press and analyst accounts rather than the fact sheet text. No public attribution of the U.S. warning to any state exists.

What the agencies said#

The fact sheet, issued jointly on 5 November and titled as a call to harden industrial refrigeration and cold-chain monitoring systems, covers sectors the five agencies oversee: health care, food and agriculture, and transportation, among others. According to press accounts of the document, it says that malicious cyber actors are going after temperature controllers and commercial refrigeration controllers that are exposed to the internet, and that a successful attacker could remotely change settings and force units into continuous heating or defrost cycles. The risks it lists are spoiled food, lost medicine and inventory, and fire.

FBI cyber official Brett Leatherman said, according to CNBC, that the government is seeing these systems targeted across critical infrastructure sectors globally. CISA's Chris Butera urged organisations to assume they could be targeted, CNBC reported. Neither the agencies' statements nor press coverage say whether any U.S. system has been hit.

How the attacks work#

Step What happens Status
1. Exposed Controllers are left reachable from the public internet Reported
2. Broken into Attackers use authentication bypass, arbitrary code injection, weak passwords or unpatched flaws Reported
3. Heat up Settings are changed so units heat or defrost; food and medicine spoil, and some units overheat Reported

Independent security research gives a sense of the weaknesses. Researchers at Claroty found that some Danfoss AK-SM controllers had a hidden daily access code that bypasses the administrator password, plus a command-injection flaw that leads to code execution on the controller; fixes have been issued. Danfoss told customers earlier to take the controllers off the internet. It also said that some systems hit in the Netherlands were still running default passwords. Security commentators add that such equipment is often installed and remotely serviced by outside refrigeration contractors, which widens who holds access. RAGE X has not seen the fact sheet's text, and the press accounts disagree on whether it names Danfoss or default passwords as entry points, so treat those details as context rather than as the advisory's findings.

The waves so far#

When Where What
Late August United States Freezers failed at U.S. military commissaries; the Pentagon is treating it as a suspected cyberattack, and has not confirmed hackers were responsible
11–12 October France About 700 sites hit; France's Foreign Ministry estimates tens of millions of euros in food losses
2 November Europe A second wave hit 100 or more stores. Counts range from six to eleven other countries, depending on the source
Early November France The French blood service (EFS) said three of its sites were targeted: temperature and defrost limits were raised, and no blood products were lost because alarms let staff intervene

Reuters says it could not establish whether the August U.S. incidents, the French campaign and the later European wave are connected. Officials have not publicly linked the blood-service incident to the October supermarket attack.

Who is behind it#

The U.S. fact sheet names no one. France is the only government to have attributed an attack: on 9 November Foreign Minister Jean-Noël Barrot said an Iran-linked IRGC unit carried out the October attack on French supermarkets (see RAGE Global's report on that accusation). France has attributed only the October attack, not the later ones. A single anonymous source told the Korea Times that the Pentagon considers Iran a suspect for the commissary failures; that is unconfirmed. Washington has not said who hit U.S. systems, or whether anyone has.

What the agencies advise#

Coverage of the guidance reports these steps:

  • take controllers off the public internet or tightly restrict remote access;
  • separate them from corporate networks;
  • replace default passwords with strong ones and, where feasible, require phishing-resistant multi-factor access;
  • apply vendor updates and retire unsupported equipment.

France's national cybersecurity agency ANSSI has issued a similar call to take exposed controllers off the open internet.

What is known#

Item Status
Five U.S. agencies warned of an "ongoing cyber threat" to refrigeration controllers on 5 November Official
The fact sheet blames unidentified "malicious cyber actors" Official
Attackers use internet exposure, authentication bypass and code injection Reported
Waves in France (October) and Europe (2 November) Official (French and European authorities)
A French blood service was targeted at three sites; no blood lost Official (EFS, French health ministry)
Freezer failures at U.S. commissaries are a cyberattack Suspected, not confirmed (Pentagon)
Any successful attack on civilian U.S. refrigeration Not reported
Who is behind the U.S. and wider European incidents Not established

Our read · RAGE Intel assessment

What is established is the warning and the European damage. What is not is any U.S. victim beyond the military commissaries, which the Pentagon only suspects, or any link between the waves. The advisory is a defensive notice, not an accusation: it names no one, and that restraint is itself information, because the U.S. government is warning before it can say who is attacking.

The pattern matters more than the attribution. The attacks use weaknesses that are cheap to find: controllers left on the internet, old firmware and weak passwords. The targets are shops, hospitals and blood supplies, not defence systems. A state at war, or in a standoff, can use that kind of sabotage against a country with no obvious military target, which is why the warning covers health, food and transport together.

This is an assessment, not a finding. It will change if U.S. officials report a confirmed civilian incident, publish an attribution, or link the August commissary failures to the European campaign.

What to watch#

  • A U.S. incident: any confirmed attack on a U.S. grocery, hospital or cold-storage site.
  • Attribution: whether Washington backs France's accusation or names its own suspect.
  • The Pentagon probe: whether the commissary failures are confirmed as a cyberattack.
  • Patching: whether vendors and operators take exposed controllers off the internet.
  • Europe: further waves, or sanctions against those France has named.

This story is developing. RAGE X will update it as new information is confirmed.

Sources#

Continue the assessment

Today's conflict risk

The daily RAGE INDEX scores global conflict risk across six theaters, with sources and forecasts.

Read the RAGE INDEX

Reach readers like these

RAGE X sells sponsored content across RAGE Intel, RAGE War and RAGE Global by proposal, always labelled as sponsored.

Request a campaign proposal