Five US agencies warn on refrigeration hacks as European freezers hit 50C

CISA issued a joint advisory on Thursday 5 November with the FBI and the Agriculture, Health and Human Services and Transportation departments, saying the agencies “are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally”. The advisory says actors are exploiting “unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities”, and tells operators to pull control systems off the public internet, segregate them from business networks, replace default passwords, patch, and retire unsupported equipment — or take systems offline until they are secure. Chris Butera, CISA’s acting executive assistant director for cybersecurity, said “every organization that depends on refrigeration and monitoring systems should assume it could be a target”. Brett Leatherman, the FBI Cyber Branch operations director, said the government was “seeing these systems targeted across critical infrastructure sectors globally”. TechCrunch reported that affected equipment included remote-controlled units made by the Danish manufacturer Danfoss, which had stopped issuing security updates for customers' freezers.

BleepingComputer reported that a November wave affected more than 115 stores across six European countries, with some systems shutting down and others driven to 50C (122F). Country and chain lists diverge between outlets: ground.news lists Sweden, Belgium, Estonia, Finland and Luxembourg on Monday 2 November, naming ICA and Coop, Delhaize and SuperValu; GovCIO, citing Reuters, lists France, Sweden, Belgium, Luxembourg and others. ICA told reporters a “limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems”; Sweden’s National Cybersecurity Center opened investigations. The least amplified detail is the sharpest: refrigeration at three French regional blood banks was targeted overnight on 1–2 November. On Monday, Israel’s National Cyber Directorate told retail chains, food companies and logistics centres to “immediately protect themselves against takeover of cooling systems”, citing European attacks that altered settings, triggered defrost cycles and in some cases caused equipment damage and fires.

The attribution sits outside the advisory. Nextgov/FCW reported, on two people familiar with the matter, that US officials suspect Iran-linked hackers behind malfunctions at roughly six on-base commissaries beginning in late August, and that those sources stress the assessment may change as the investigation proceeds; it remains unclear how the attackers reached the control systems. Reuters reported last week that Pentagon investigators are treating the August commissary failures as a cyberattack. Militarnyi credited the Iran line to Defense One, but Defense One and Nextgov/FCW are both GovExec titles — one reporting line, not two confirmations. The only named voice attached to the Iran theory is Nahman Khayet of Alt Security, a vendor, who said the hacks follow a pattern closely aligned with Iranian operators. No government body has attributed the campaign publicly, and nobody has claimed it.

Assessment: Note what the advisory does not do. Five federal agencies told the private sector to assume it is a target and said nothing about who is doing the targeting, while anonymous officials carried the Iran line to the trade press in the same week FDD’s brief led with US strikes on Qeshm Island and reported planning for further strikes after the midterms. That gap between what is signed and what is briefed is the story. The operational facts are solid and unglamorous: the exposed surface is a decade of internet-connected controllers nobody treated as critical infrastructure, including a vendor that stopped patching. Israel’s directorate issued its warning about a campaign that has not hit Israel and that no actor has claimed. Watch the blood banks, not the groceries.