Pull to refresh
Logo
What Changed
Following Why Sign Up
U.S. agencies warn of ongoing attacks on industrial refrigeration controllers

U.S. agencies warn of ongoing attacks on industrial refrigeration controllers

Force in Play

Internet-connected temperature controllers at grocery stores, cold storage and military commissaries have been manipulated across at least a dozen countries, and European authorities are still working out who is behind it.

6 days ago: Five U.S. agencies issue joint advisory

Overview

Updated 3 days ago

In August 2026, refrigerators failed at U.S. military commissaries. Attacks then hit hundreds of French supermarkets in October and spread in early November to stores in at least eight European countries, including Italy, Sweden and Belgium.

On November 5, five U.S. agencies issued a joint advisory warning that attackers can force internet-connected controllers into continuous heating, risking spoiled food and fire. The European Commission has convened an EU task force, and Britain's National Cyber Security Centre says it worked through the night contacting operators whose equipment was exposed.

Why it matters

The same internet-connected controllers that keep food cold can be ordered to heat it, and thousands remain exposed.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

12+
Countries with reported attacks
TechCrunch reported attacks in at least a dozen countries as of November 5.
107
Defense Commissary stores worldwide
The Pentagon's grocery chain operates 107 stores in the U.S. and abroad, according to NPR.
5
U.S. agencies issuing the advisory
CISA, the FBI, HHS, USDA and the Department of Transportation signed the November 5 statement.
8
European countries in the November wave
U.S. News reported stores in eight European countries threw away food after the early-November attacks; Italy, Sweden, Belgium, Luxembourg, Ireland and Estonia were among them.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

Organizations Involved

Cybersecurity and Infrastructure Security Agency (CISA)
Cybersecurity and Infrastructure Security Agency (CISA)
United States federal agency
Co-author of the November 5 joint advisory; no attribution issued

The Department of Homeland Security agency responsible for federal cybersecurity guidance and incident coordination.
Federal Bureau of Investigation (FBI)
Federal Bureau of Investigation (FBI)
US federal law enforcement agency
Co-author of the November 5 joint advisory; no suspect or country named publicly

The Justice Department's principal federal investigative agency, which published the advisory through its Internet Crime Complaint Center.
Danfoss
Danfoss
Manufacturer
Controller maker named in French alert and NPR review

Danish industrial manufacturer whose refrigeration controllers appear in the affected estates.
Defense Commissary Agency
Defense Commissary Agency
Defense Department Agency
Operator of commissaries that reported outages

The Pentagon agency that runs grocery stores on U.S. military installations worldwide.
AG
Agence nationale de la sécurité des systèmes d'information
National Cybersecurity Agency
Investigating the French supermarket incidents

France's national cybersecurity agency, known as ANSSI.
European Union Agency for Cybersecurity (ENISA)
European Union Agency for Cybersecurity (ENISA)
EU Agency
Coordinating information-sharing across member states

The EU agency that issued a joint statement on the refrigeration incidents.
Claroty
Claroty
Cybersecurity Firm
Identified exposed refrigeration systems

Industrial cybersecurity firm whose researchers examined the exposed controllers.
National Cyber Security Centre (NCSC)
National Cyber Security Centre (NCSC)
UK government cybersecurity agency
Warning operators and contacting exposed organizations

Britain's cyber agency, which issued warnings after the European supermarket attacks.
European Commission
European Commission
EU executive body
Coordinating with national authorities; convened EU task force meeting

The EU's executive arm, which convened an interinstitutional task force over the refrigeration attacks.
CS
Coop Sverige
Swedish grocery chain
Moved affected stores off the public internet

Swedish supermarket chain whose stores reported refrigeration problems in the early-November wave.

Timeline

August 2026 November 2026

8 events Latest: 6 days ago
Tap a bar to jump to that date

  1. Five U.S. agencies issue joint advisory

    Latest Statement

    CISA, FBI, HHS, USDA and DoT warn of ongoing attacks on refrigeration controllers.

  2. Attacks spread across European supermarkets

    Incident

    Sweden, Estonia, Ireland, Luxembourg, the Netherlands, Belgium and Italy report refrigeration disruptions. U.S. News reported stores in eight European countries threw away food.

  3. European Commission convenes EU task force

    Government response

    The Commission said it was in direct contact with national authorities and convened a meeting of the EU interinstitutional task force with law enforcement and cybersecurity agencies.

  4. UK cyber agency contacts exposed operators overnight

    Government response

    National Cyber Security Centre chief Richard Horne told reporters the French fridges were connected directly to the internet with default passwords. The centre issued warnings and worked through the night contacting organisations with vulnerable technology exposed.

  5. France's CERT-FR issues controller alert

    Alert

    Alert names Danfoss and Dixell XWEB systems, without identifying the vulnerability.

  6. Cyber incidents hit EU commercial refrigeration

    Incident

    ENISA reports commercial refrigeration systems in several member states affected.

  7. Hundreds of French supermarkets disrupted

    Incident

    Intermarché, Coopérative U and Carrefour stores report refrigeration disruptions.

  8. Refrigeration outages hit U.S. military commissaries

    Incident

    Multiple commissaries report outages; the Pentagon calls it a "possible refrigeration disruption."

Scenarios

1

New confirmed refrigeration attacks hit another country

Likely Resolves by Q2 2027

Discussed by: CISA, ENISA and national computer emergency response teams

Controllers remain exposed on public networks, and the advisory offers guidance rather than a technical fix. If operators do not remove devices from the internet or change default credentials, the same entry points remain open. A confirmed incident in a country not named in the November advisory would show the campaign is still expanding.

2

U.S. formally attributes the campaign to a foreign government

Possible Resolves by Q2 2027

Discussed by: NPR, citing two former officials; Nextgov first reported the Iran suspicion

Investigators are treating the commissary outages as a cyberattack, and two former officials told NPR some evidence points toward Iran, though with low confidence. A formal attribution would require the FBI, the Justice Department or the Treasury Department to name a government publicly, which none has done.

3

Regulators require security controls for cold-chain controllers

Unlikely Resolves by End of 2027

Discussed by: Food-safety and critical-infrastructure policy analysts

The advisory is voluntary guidance. A binding rule would require a regulator to mandate authentication, network isolation or internet-exposure limits for refrigeration controllers. The Food and Drug Administration, the U.S. Department of Agriculture or the European Commission would be the likely authors.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2009-2010

Stuxnet (2010)

A worm built to attack Iranian nuclear enrichment reached industrial controllers made by Siemens. It changed centrifuge speeds while reporting normal readings to operators. The malware spread beyond its target through removable drives.

Then

Iran's enrichment program was set back and the worm spread to computers in several countries.

Now

Stuxnet became the reference case for malware that causes physical damage through industrial control systems.

Why this matters now

The refrigeration attacks use the same core mechanism: alter a controller's settings while its displays and alarms tell operators everything is normal.

December 2015

Ukraine grid attack (2015)

Attackers used remote access to open circuit breakers at three Ukrainian electricity distribution companies. They also disabled operator displays and wiped files, leaving controllers running but unmonitored.

Then

About 225,000 customers lost power for several hours.

Now

The incident established that remote access to operational technology can produce physical effects at scale.

Why this matters now

The refrigeration advisory's warning about lost temperature visibility, or denial-of-view, describes the same tactic.

September-October 2016

Mirai botnet (2016)

Malware scanned the internet for connected devices still using factory default credentials. It assembled them into a botnet and used it to knock major websites offline.

Then

A large denial-of-service attack disrupted access to major internet services for hours.

Now

Default passwords and internet-exposed devices became a standard checklist item for network security.

Why this matters now

The refrigeration advisory lists default passwords and internet exposure as the first problems to fix, a decade after Mirai showed the cost of ignoring them.

Sources

(14)
+8
Internet Crime Complaint Center TechCrunch NPR Nextgov/FCW The Record from Recorded Future News ENISA Previdian Reuters via Investing.com Cybersecurity Dive AFP SC Media U.S. News & World Report / Reuters NPR via KUNM U.S. News & World Report