US federal agencies are sounding the alarm over a growing wave of attacks targeting industrial refrigeration and cold-chain monitoring systems. Threat actors have been exploiting vulnerable, internet-facing controllers to tamper with temperature settings or trigger defrost cycles—putting food, medicine, and equipment at risk, and raising the danger of fires.
What’s happening
Recently, a joint advisory from multiple federal agencies—including CISA, the FBI, HHS, USDA, and DOT—warns that industrial refrigeration systems globally are being actively compromised. Attackers are gaining access through weaknesses like authentication bypasses, weak configurations, legacy devices, or unpatched software. Once inside, they’re changing temperature thresholds or continuously pushing defrost cycles, leading to inventory spoilage, equipment damage, fire hazards, and even risks to public health. Part of the disruption comes not just from manipulation, but from loss of visibility when systems are knocked offline by denial-of-service attacks.
In Europe, these attacks have hit hundreds of supermarkets from major chains to small grocers. In many cases, controllers exposed online have allowed bad actors to raise temperatures as high as 50 °C (122 °F) or force cooling components into non-functional, constantly defrosting states, spoiling products. A significant incident involved France’s Blood Establishment—refrigeration settings for three plasma storage sites were reportedly driven to “extremely high levels.”
Why exposures persist
New data shows that internet-exposed instances of refrigeration controllers—manufactured by companies like Danfoss and Dixell—remain common. One monitoring platform recorded over 3,000 exposed Danfoss StoreView controllers in early October; by November, that number had dropped but still stood in the hundreds. Similar trends were observed for Copeland/Dixell XWEB systems. North America currently represents about 38% of such exposed industrial control systems (ICS) globally, a higher share than Europe or Asia, though all regions continue to carry risk.
The goal behind many of these attacks appears financial: disrupting a business by spoiling inventory and halting operations. But the stakes are rising. Food safety, public health, and essential supplies like blood plasma are now squarely in the crosshairs.
What can organizations do
Operators and owners of refrigeration and cold-chain systems are urged to take concrete steps to defend themselves. Among the most critical actions: disable or remove unnecessary remote access, change default passwords, adopt strong authentication methods, isolate operational technology (OT) networks from the internet, and phase out outdated legacy devices. Keeping firmware and software patched is essential. Where remote access is needed, it should be restricted and monitored carefully.
Furthermore, organizations are advised to inventory all systems controllable via the internet, identify potential weak points, and ensure visibility over system health and environmental metrics. Having backup monitoring and alerting in case temperature sensors fail or get disabled is part of the defensive playbook.
Anxiety over ICS safety isn’t new, but the current wave of attacks delivering real-world loss makes the situation more urgent than ever.
Analytical angle: This surge in attacks on refrigeration infrastructure highlights a broader shift in cyber threat landscapes—moving beyond data theft toward physical, safety-critical disruption. The food and medical supply chains form fragile links deeply dependent on reliable OT systems. As exposure of these systems remains high—even declining numbers still constitute a large vulnerable surface—organizations can’t afford reactive security anymore. The ones that will come out ahead are those integrating cybersecurity into physical safety practices: supply chain visibility, strong OT/IT separation, proactive threat hunting, and resilient response planning. Watch for vendors to step up, regulatory pressure to increase, and insurers to demand these mitigations as hygiene requirements, not optional extras.
