The Freezers Were Hacked. The Food Spoiled.

Hackers are not just stealing data from supermarkets anymore. They are turning up the heat — literally. The FBI and CISA have issued a joint warning that attackers are actively targeting industrial refrigeration and cold-chain monitoring systems around the world, forcing freezers into defrost, raising temperatures to 50°C (122°F), and in some cases shutting the equipment down entirely.

The warning, published Thursday, was issued jointly with the U.S. Departments of Health and Human Services, Agriculture, and Transportation. It urges operators of refrigeration controllers used in healthcare, food production, chemical facilities, and transportation to treat the threat as live — because it is.

“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s Acting Executive Assistant Director for Cybersecurity.

What the attackers are doing

The targets are the electronic temperature controllers and commercial refrigeration management systems that let operators monitor temperatures remotely, manage defrost cycles, and control cooling equipment. According to the advisory, attackers are getting in through unpatched flaws, internet-accessible controllers, authentication bypasses, code injection, and weak configurations.

Once inside, they change temperature settings and force equipment into continuous heating or defrost cycles. Worse, they can reduce visibility into the real temperatures, so operators cannot see the problem developing. The consequences go beyond spoiled food: inventory losses, damaged equipment, fire hazards, and unsafe storage conditions for medicine and blood products.

The warning follows a wave of real attacks in Europe. In October, hackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets, remotely activating defrost functions and raising temperatures in refrigerators and freezers. A second wave in November hit more than 115 stores across six European countries, with some systems shutting down entirely and others pushing temperatures as high as 50°C (122°F).

On November 3, the French Blood Establishment confirmed that a cybersecurity incident at a refrigeration equipment provider had altered temperature and defrost settings at three facilities used to store blood products. The food on a supermarket shelf and the blood in a hospital fridge run on the same kind of controller — and attackers have now shown they will go after both.

Why a fridge is a hacking target

A refrigeration controller is a small computer that was never designed to be a computer. Many of these devices were built to sit on a closed local network, with a default password, no encryption, and no update mechanism — and then, over the years, they got connected to the internet so someone could check the temperature from home.

That is the same story we keep seeing with internet-exposed equipment. QNAP storage devices were breached through flaws in software that should never have been reachable from the outside, and more than 1.3 million Android TV boxes shipped with a backdoor built in at the factory. The refrigeration controllers are the same class of problem: operational equipment, exposed to the internet, running old software with known weaknesses.

The difference here is the blast radius. A compromised TV box spies on one household. A compromised refrigeration controller can spoil the food for a whole supermarket, ruin a hospital’s blood supply, or start a fire. The agencies’ warning covers healthcare, food production, chemical facilities, and transportation precisely because cold storage sits underneath all of them.

What operators should check now

The agencies’ advice is direct, and it applies to any organization running refrigeration equipment:

• Take controllers off the public internet. If a refrigeration controller is reachable from the internet and it does not absolutely need to be, remove that access today. Remote monitoring should go through a VPN or a secured gateway, never a direct connection.
• Change default passwords — and enforce real ones. Default credentials are the first thing attackers try, and on this class of device they still work far too often. Every controller should have a unique, strong password, and any account that does not need remote access should not have it.
• Apply available security updates. Vendors have released fixes for several of these controllers. If your equipment has an update pending, install it — and if your controller is end-of-life with no patches coming, plan its replacement now.
• Isolate the operational network. Refrigeration systems should sit on their own network segment, separated from the business network, so a compromised office PC cannot reach the freezers.
• Set safe temperature limits in the hardware. A controller should not be able to push a freezer to 50°C just because a remote command told it to. Enforce hard limits that keep the equipment inside a safe range no matter what the software says.

The European attacks show how fast this moves from a warning to a warehouse full of spoiled food. The first wave hit hundreds of French stores in October; the second wave crossed six countries within days. The U.S. agencies are warning now, before the same campaign reaches American cold chains, because the fixes — taking controllers offline, changing passwords, patching — are all things an operator can do this week. The time to find out your freezers are reachable from the internet is not the morning the temperature alarms go off.