Five federal agencies issued a joint advisory on November 5, 2026, urging critical infrastructure operators to harden industrial refrigeration and cold chain monitoring systems against active cyber intrusions. The Cybersecurity and Infrastructure Security Agency, FBI, Department of Health and Human Services, Department of Agriculture, and Department of Transportation announced the joint advisory following widespread attacks on cooling facilities.
The alert warns operators of food processing plants, grocery stores, bulk warehouses, and medical storage hubs that intruders are targeting authentication bypass flaws, arbitrary code execution, and weak configurations in unpatched or exposed controllers. In successful breaches, attackers remotely adjust cooling settings, trigger non-stop defrost or heating cycles, cause physical fire hazards, ruin perishable goods, and disable real-time temperature telemetry.
"Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors," said Brett Leatherman, operations director of the FBI Cyber Branch. "The FBI urges every organization that relies on these systems to review our guidance, implement the recommended mitigations, and report any suspicious activity to the FBI."
Recommended network isolation steps
Federal authorities instructed operators to disconnect controller panels from the public internet immediately. Facilities must place operational technology devices on dedicated virtual local area networks isolated from enterprise business systems, update default passwords, and activate phishing-resistant multifactor authentication.
The agencies also told operators to configure strict physical setpoint limits on downstream refrigeration hardware and establish automated alerts to prevent units from running outside safe temperature ranges.
Wave of European facility breaches
The advisory follows disruptions across Europe. In October, attackers breached Danfoss StoreView systems across an estimated 250 to 350 supermarkets in France, driving unit temperatures up to 50 degrees Celsius. In early November, a second wave hit more than 115 retail locations across nations including Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia, and the Netherlands. On November 3, 2026, France's National Blood Service reported that an intrusion at refrigeration supplier Coolworld manipulated defrost settings, raising storage rooms to 110 degrees Celsius across three facilities.
Domestic exposure remains under scrutiny. The Department of the Army Criminal Investigation Division confirmed it is investigating unexplained refrigeration failures that occurred at six military bases in August 2026. Data published by Censys reportedly showed a 53 percent drop in exposed Danfoss and Copeland/Dixell controllers as managers disconnected equipment following the European breaches.
