On Monday, November 2, temperatures inside one European supermarket reportedly climbed as high as 50°C (122°F), enough to spoil the food in its cases. That store was not alone. Hackers overrode temperature controls on commercial refrigeration equipment at more than 350 French establishments, forcing supermarkets to discard spoiled food, according to Nextgov.
On Thursday, November 5, the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation issued a refrigeration cyberattack warning in a joint fact sheet. It targets industrial refrigeration and cold chain monitoring systems. The warning follows weeks of incidents in Europe and a Pentagon probe of U.S. base freezers that became public in late October. For grocers, hospitals and food transporters, a controller problem has become a supply problem.
What the refrigeration cyberattack warning says
The fact sheet names several weaknesses attackers could exploit: authentication bypass, arbitrary code injection and weak configurations in unpatched or internet-accessible temperature and refrigeration controllers. Its most direct instruction is to remove control system devices and systems from the internet altogether. The agencies also recommend a dedicated VLAN for operational technology devices, replacing default passwords, phishing-resistant multifactor authentication, prompt patching, retiring unsupported legacy devices, IP allow-lists, offline backups and regular log review.
Chris Butera, CISA’s acting executive assistant director for cybersecurity, framed the risk in coverage of the advisory: “Every organization that depends on refrigeration and monitoring systems should assume it could be a target.” The FBI’s Cyber Branch operations director, Brett Leatherman, said in a statement: “We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk.”
The exposure is wide. The advisory’s audience includes grocery chains, cold-storage warehouses, hospitals and blood banks, food and drug transporters, military commissaries and chemical facilities that rely on networked refrigeration controllers. The Food and Agriculture Information Sharing and Analysis Center has separately warned that attackers are going after internet-accessible industrial controls that may lack strong defenses.
Europe’s supermarket freezer attacks by the numbers
| Location | When | What was reported |
|---|---|---|
| More than 350 French establishments | October into early November | Temperature controls overridden; supermarkets discarded spoiled food |
| One European store | Monday, November 2 | Temperatures reportedly reached 50°C (122°F) |
| Three French national blood banks | Not specified in reporting | Cooling controls tampered with |
The French figure needs a caveat. A WindowsForum summary citing BleepingComputer puts the number of affected French supermarkets at 250 to 350. The two counts have not been reconciled, so treat the higher number as a reported figure, not a verified total.
CNBC reported that other retailers discarded food as well. No group has claimed the attacks, and responsibility remains unknown. The blood bank tampering is the most sensitive detail in the European reporting, though connections between the incidents remain unclear. Monday’s incident and the links between the October and November waves are still under investigation.
Reuters reported that experts had previously told it the French attack appeared easy to pull off. The agency also noted that hackers have sabotaged fridges and freezers in the United States and elsewhere before. That history suggests the weakness is not new. What is new is the federal government putting its name behind a formal warning.
The U.S. military commissary freezer failures
Reuters reported on October 29 that the Pentagon is treating a spate of freezer malfunctions as a suspected hack, citing four officials familiar with the matter. The late-August malfunctions affected at least six commissaries, the on-base stores where service members buy food. Reuters reached that count by reviewing the bases’ Facebook posts and website updates, according to its report.
At Fort Huachuca in Arizona, officials reported that a freezer entered defrost mode and heated its contents, leaving the food spoiled. A Pentagon statement said a unit of Cyber Command was “working in close coordination with interagency and law enforcement partners.” It did not elaborate. Military Times carried the same details.
Several gaps remain. The Pentagon has not publicly confirmed a cyberattack, and Reuters could not establish which controller brands the bases used. Whether the U.S. failures and the European attacks are linked is still unclear. The U.S. incidents happened in August, before the European wave drew wide attention, and the Pentagon’s probe predates the federal advisory.
Whether American grocery fridges have been hacked
Not in any publicly documented way so far. The Register reported that it was not aware of any documented digital attacks against these systems in American supermarkets. The FBI had not responded to its question about attempted attacks at the time of publication. That silence calls for caution rather than comfort, because the absence of public reports does not show whether an attempt was made and stopped.
The advisory covers industrial and commercial systems, not the refrigerator in your kitchen. For shoppers, the realistic risk is indirect. The likely effects are spoiled food and disrupted supply, which is what the European stores experienced.
What operators should do this week
- Check your own exposure. Confirm whether any refrigeration controller or monitoring dashboard can be reached from the internet, and remove it from public access.
- Move operational technology devices onto separate network segments.
- Replace default passwords and turn on phishing-resistant multifactor authentication.
- Patch what can be patched, and retire legacy controllers that no longer receive support.
- Keep offline backups so you can recover if a controller is manipulated.
- Monitor temperatures through a source independent of the controller, so you can spot a system doing something it should not.
Add IP allow-lists to limit who can reach any system that must stay online, and review logs on a regular schedule.
What shoppers can do and what comes next
Shoppers have little they can do directly. If a store has unusually warm cases, visibly spoiled product or an unexplained closure, report it to your local health authorities. Those reports help officials tell isolated equipment failures apart from a pattern.
Several questions will shape the next phase. Watch whether the FBI answers the Register’s question about attacks on American supermarkets, whether the Pentagon names a cause for the August failures, and whether French investigators assign responsibility. Watch also whether the 250-to-350 and 350-plus counts get reconciled, and whether CISA updates its fact sheet as more incidents surface. The answers will show whether this is a short-lived spree or the start of a sustained campaign against the systems that keep food and medicine cold.
