On November 5, 2026, the US cybersecurity agency CISA, the FBI and several federal departments issued a joint warning about an "ongoing cyber threat": industrial freezer cyberattacks and attacks on cold chain monitoring systems. Refrigerators that seem harmless in supermarkets, cold stores and military bases are being tampered with remotely. The damage isn't confined to servers. It shows up as spoiled food, compromised medicine and blood supplies at risk.

For software companies and operations teams, it's a pointed reminder: every internet-connected device is part of your attack surface.

What the CISA and FBI warning says

According to TechCrunch, the statement came on Thursday from CISA, the FBI and the US departments of Agriculture, Health and Human Services, and Transportation. The agencies say hackers are targeting internet-connected refrigeration and cold chain monitoring systems in grocery stores and cold storage facilities. The affected sectors include food, agriculture, transportation and the shipping of medicines.

The worst case is spelled out: attackers could change temperatures, creating fire hazards, destroying inventory and shortening equipment life. A companion fact sheet warns that units could be forced into continuous heating and defrost cycles. CISA's acting cybersecurity chief, Chris Butera, said any organization that relies on refrigeration and monitoring systems should assume it could be a target.

From France to Northern Europe: two waves in under a month

The US warning follows a string of incidents. Last month, attacks on freezers in France caused food spoilage at hundreds of supermarkets by deliberately raising temperatures. On November 2, 2026, a second wave hit dozens of stores in Belgium, Ireland, Luxembourg and Sweden. Ahold Delhaize and Colruyt confirmed the attacks, and one Belgian operator of Delhaize's systems said the hackers had switched settings to defrost. Many stores had to throw away large amounts of food.

A blood bank in France was also targeted, with refrigerators holding donated blood pushed to higher temperatures, though the attack was stopped before blood stocks were affected. The US Department of Defense is investigating a series of freezer incidents at military bases.

Unsupported hardware is the weak link

What stands out for engineers is the cause. Security researchers point to remote-controlled refrigeration controllers from Danish manufacturer Danfoss, which had stopped providing security updates for them. Claroty had warned back in August that these controllers were at risk of remote takeover and outages.

In other words, the weakness was known for months, and the devices stayed online. It's a familiar pattern: hardware outlives its software support, and nobody owns the patching.

As for who is responsible, the US government has not named a group or country. Some researchers broadly attribute the attacks to Iran, and US officials reportedly suspect the same, but this is not an official attribution.

What businesses should do now

The agencies' advice is practical and applies to most OT and IoT environments, from cold storage to factories and smart buildings:

  • Take remote control interfaces off the internet. If remote access is essential, put it behind a VPN or strongly authenticated gateway.
  • Change default passwords, tighten password policy and enable multi-factor authentication where supported.
  • Patch where possible and follow vendor security notices.
  • Retire unsupported equipment, or isolate it on a separate network segment.
  • Add independent temperature monitoring, with sensors and alerts that don't depend on the same controller, to catch anomalies early.

For software teams the lesson is broader. When building device management apps, don't expose admin ports publicly by default, plan long-term firmware updates, and log enough detail to trace configuration changes. For another example of attackers exploiting a flaw over many months, read our piece on the DreamHost attack that exposed session tokens and customer emails.

Don't forget the human factor

Many infrastructure attacks begin with something ordinary, such as a stolen login. Alongside patching, train operations staff to spot fake emails and messages, as covered in our guide to recognizing phishing emails and messages.

Conclusion

The freezer attacks show that cybersecurity now touches food and healthcare supply chains directly. Three takeaways: unsupported devices are the biggest risk, remote controls shouldn't face the internet, and you need an independent monitoring layer. If your business runs IoT systems or software that connects to devices, contact Besoft to review your architecture and security processes before an incident forces the issue.

Sources

  • TechCrunch, "U.S. government warns of 'ongoing cyber threat' amid mass-hacks of industrial retail and military freezers", November 5, 2026: https://techcrunch.com/2026/11/05/u-s-government-warns-of-ongoing-cyber-threat-amid-mass-hacks-of-industrial-retail-and-military-freezers/
  • TechCrunch, "A fresh wave of cyberattacks has hit Europe's supermarket refrigerators, destroying food across countries", November 2, 2026: https://techcrunch.com/2026/11/02/a-fresh-wave-of-cyberattacks-has-hit-europes-supermarket-refrigerators-destroying-food-across-countries/