FBI and CISA Warn of Active Attacks on Refrigeration Controllers After European Supermarket and Blood Storage Hits

Attackers are reaching into refrigeration controllers over the internet and turning cold storage into heat sources. On November 5, 2026, the FBI and CISA, joined by the Departments of Health and Human Services, Agriculture and Transportation, published a joint advisory warning that malicious actors are actively targeting electronic temperature controllers and commercial refrigeration management systems worldwide. The advisory follows two waves of European attacks that hit hundreds of supermarkets and three blood storage facilities in under two months.

CISA's position is blunt. "Every organization that depends on refrigeration and monitoring systems should assume it could be a target," said Chris Butera, CISA's Acting Executive Assistant Director for Cybersecurity.

What Happened in Europe

The U.S. warning is a response to a campaign that has already produced physical consequences. The sequence reported so far:

• October 2026: attackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets, remotely triggering defrost functions and raising temperatures in refrigerators and freezers.
• November 2026: a second wave hit more than 115 stores across six European countries. Some refrigeration systems shut down entirely. Others were driven to temperatures as high as 50°C (122°F).
• November 3, 2026: the French Blood Establishment (EFS) confirmed that a cybersecurity incident at a refrigeration equipment provider altered temperature and defrost settings at three facilities used to store blood products.

The EFS incident is the most significant data point. The compromise ran through a third-party refrigeration provider, not the blood service's own network. That pattern, where a vendor's remote management path becomes the attack path, is common in OT and is the reason cold-chain operators cannot treat this as a problem limited to devices they directly manage.

How the Attacks Work

According to the advisory, the targets are unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage environments. These devices let operators monitor temperatures remotely, schedule defrost cycles and control cooling hardware. The same features that make them useful for an overnight store with no staff on site make them valuable to an attacker.

The agencies list three classes of weakness being exploited:

• Authentication bypass vulnerabilities that grant control without valid credentials.
• Arbitrary code injection flaws in controller firmware or management interfaces.
• Weak configurations, including default passwords and management interfaces exposed directly to the public internet.

Once inside, attackers change setpoints and force equipment into continuous heating or defrost cycles. A defrost cycle is a normal maintenance function, which means a malicious one can look legitimate in logs and on local displays. Combined with the ability to reduce visibility into current temperatures, this gives attackers hours of undetected runtime in a facility that is closed overnight.

The advisory and public reporting do not name a specific vendor, product line, CVE or threat actor. Organizations should not read that gap as reassurance. The agencies describe the activity as global and opportunistic against exposed devices, which means exposure, not brand, is the primary risk factor.

Who Is Exposed

The advisory explicitly names healthcare, food production, chemical facilities and transportation, alongside retail grocery and cold storage. The common thread is any operation where a temperature excursion has a direct cost:

• Grocery chains and independent stores with remote refrigeration monitoring, often installed and managed by a third-party contractor.
• Hospitals, blood services, pharmacies and labs storing temperature-sensitive biologics, vaccines and reagents.
• Food processors and cold storage warehouses where a single overnight excursion can condemn an entire inventory.
• Chemical facilities where loss of cooling can create safety hazards beyond financial loss.
• Refrigerated logistics and transportation operators with telematics-connected units.

Many of these deployments were installed by HVAC or refrigeration contractors, not IT. They frequently sit outside asset inventories, outside vulnerability scanning scope and outside the security team's line of sight. Search engine indexes of internet-connected devices have shown exposed refrigeration management interfaces for years.

Agency Recommendations

The joint advisory sets out the following mitigations for operators and their equipment vendors:

• Remove refrigeration controllers from direct public internet exposure.
• Secure any remote access that is operationally required.
• Change default passwords on controllers and management systems.
• Apply available vendor security updates.
• Isolate operational technology systems from business networks.
• Enforce safe temperature limits so controllers cannot be driven outside acceptable ranges, regardless of commands received.

RedEye Assessment

This campaign is a clear demonstration of low-effort, high-impact OT attacks. Nothing in the reporting suggests advanced tooling. The attackers found exposed management interfaces, used known weakness classes, and abused a legitimate maintenance function to cause physical damage at scale. The jump from roughly 300 stores in one country to more than 115 stores in six countries within weeks indicates either a repeatable playbook or a shared vendor platform being exploited across customers.

U.S. operators should expect the same activity. Refrigeration controllers are a long-tail OT asset class: cheap, widely deployed, managed by contractors, and rarely patched. The EFS case shows the vendor remote access path deserves as much scrutiny as the devices themselves. Organizations that cannot quickly answer how many refrigeration controllers they have, who manages them and whether any are reachable from the internet should treat that as the first finding.