U.S. agencies warn of ongoing attacks on industrial refrigeration controllers

Overview

Updated 1 hour ago

In August 2026, refrigerators failed at U.S. military commissaries. By October, hundreds of French supermarkets were hit, and in early November the disruptions reached stores in at least six more European countries.

The common element was the controller: an internet-connected device that sets temperatures, runs defrost cycles and reports alarms. On November 5, five U.S. agencies issued a joint advisory warning that attackers can force these units into continuous heating.

The advisory names authentication bypass, code injection and weak configurations as entry points. It warns of inventory loss, fire hazards and unsafe food, and says operators may lose visibility into temperatures entirely.

Why it matters

The same internet-connected controllers that keep food cold can be ordered to heat it, and thousands remain exposed.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

12+

Countries with reported attacks

TechCrunch reported attacks in at least a dozen countries as of November 5.

107

Defense Commissary stores worldwide

The Pentagon's grocery chain operates 107 stores in the U.S. and abroad, according to NPR.

U.S. agencies issuing the advisory

CISA, the FBI, HHS, USDA and the Department of Transportation signed the November 5 statement.

European countries in the early-November wave

Sweden, Estonia, Ireland, Luxembourg, the Netherlands and Belgium reported disruptions.

Voices

Curated perspectives — historical figures and your fellow readers.

Organizations Involved

Cybersecurity and Infrastructure Security Agency (CISA)

United States federal agency

Co-author of the November 5 joint advisory

The Department of Homeland Security agency responsible for federal cybersecurity guidance and incident coordination.

Federal Bureau of Investigation (FBI)

US federal law enforcement agency

Co-author of the joint advisory

The Justice Department's principal federal investigative agency, which published the advisory through its Internet Crime Complaint Center.

Danfoss

Manufacturer

Controller maker named in French alert and NPR review

Danish industrial manufacturer whose refrigeration controllers appear in the affected estates.

Defense Commissary Agency

Defense Department Agency

Operator of commissaries that reported outages

The Pentagon agency that runs grocery stores on U.S. military installations worldwide.

Agence nationale de la sécurité des systèmes d'information

National Cybersecurity Agency

Investigating the French supermarket incidents

France's national cybersecurity agency, known as ANSSI.

European Union Agency for Cybersecurity (ENISA)

EU Agency

Coordinating information-sharing across member states

The EU agency that issued a joint statement on the refrigeration incidents.

Claroty

Cybersecurity Firm

Identified exposed refrigeration systems

Industrial cybersecurity firm whose researchers examined the exposed controllers.

Timeline

August 2026 November 2026

6 events Latest: Today

Tap a bar to jump to that date

November 2026
Five U.S. agencies issue joint advisory
Today Statement

CISA, FBI, HHS, USDA and DoT warn of ongoing attacks on refrigeration controllers.
Today
Attacks spread to six more European countries
Incident

Sweden, Estonia, Ireland, Luxembourg, the Netherlands and Belgium report disruptions.
November 2026
October 2026
France's CERT-FR issues controller alert
Alert

Alert names Danfoss and Dixell XWEB systems, without identifying the vulnerability.
October 12th, 2026
Cyber incidents hit EU commercial refrigeration
Incident

ENISA reports commercial refrigeration systems in several member states affected.
October 11th, 2026
Hundreds of French supermarkets disrupted
Incident

Intermarché, Coopérative U and Carrefour stores report refrigeration disruptions.
October 2026
August 2026
Refrigeration outages hit U.S. military commissaries
Incident

Multiple commissaries report outages; the Pentagon calls it a "possible refrigeration disruption."
August 2026

Scenarios

New confirmed refrigeration attacks hit another country

Likely Resolves by Q2 2027

Discussed by: CISA, ENISA and national computer emergency response teams

Controllers remain exposed on public networks, and the advisory offers guidance rather than a technical fix. If operators do not remove devices from the internet or change default credentials, the same entry points remain open. A confirmed incident in a country not named in the November advisory would show the campaign is still expanding.

U.S. formally attributes the campaign to a foreign government

Possible Resolves by Q2 2027

Discussed by: NPR, citing two former officials; Nextgov first reported the Iran suspicion

Investigators are treating the commissary outages as a cyberattack, and two former officials told NPR some evidence points toward Iran, though with low confidence. A formal attribution would require the FBI, the Justice Department or the Treasury Department to name a government publicly, which none has done.

Regulators require security controls for cold-chain controllers

Unlikely Resolves by End of 2027

Discussed by: Food-safety and critical-infrastructure policy analysts

The advisory is voluntary guidance. A binding rule would require a regulator to mandate authentication, network isolation or internet-exposure limits for refrigeration controllers. The Food and Drug Administration, the U.S. Department of Agriculture or the European Commission would be the likely authors.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2009-2010

Stuxnet (2010)

A worm built to attack Iranian nuclear enrichment reached industrial controllers made by Siemens. It changed centrifuge speeds while reporting normal readings to operators. The malware spread beyond its target through removable drives.

Then

Iran's enrichment program was set back and the worm spread to computers in several countries.

Now

Stuxnet became the reference case for malware that causes physical damage through industrial control systems.

Why this matters now

The refrigeration attacks use the same core mechanism: alter a controller's settings while its displays and alarms tell operators everything is normal.

December 2015

Ukraine grid attack (2015)

Attackers used remote access to open circuit breakers at three Ukrainian electricity distribution companies. They also disabled operator displays and wiped files, leaving controllers running but unmonitored.

Then

About 225,000 customers lost power for several hours.

Now

The incident established that remote access to operational technology can produce physical effects at scale.

Why this matters now

The refrigeration advisory's warning about lost temperature visibility, or denial-of-view, describes the same tactic.

September-October 2016

Mirai botnet (2016)

Malware scanned the internet for connected devices still using factory default credentials. It assembled them into a botnet and used it to knock major websites offline.

Then

A large denial-of-service attack disrupted access to major internet services for hours.

Now

Default passwords and internet-exposed devices became a standard checklist item for network security.

Why this matters now

The refrigeration advisory lists default passwords and internet exposure as the first problems to fix, a decade after Mirai showed the cost of ignoring them.