US agencies warn of ongoing hacking campaign hitting refrigeration systems at military bases, supermarkets, and a blood bank

The US government issued a joint warning on Thursday about an ongoing hacking campaign targeting internet-connected refrigeration and cold-chain monitoring systems, after attackers compromised freezers and chillers at supermarkets around the world, US military bases, and at least one blood bank in France.

The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, joined by the Departments of Agriculture, Health and Human Services, and Transportation, said the hacks affect critical infrastructure spanning the food, agriculture, transportation, and medical-logistics sectors. A companion fact sheet warns that attackers who gain control of these systems can alter temperature settings, triggering fire hazards, spoiling inventory, and shortening equipment lifespan — or force units into repeated heating-and-defrost cycles.

A pattern stretching across continents

Two waves of attacks have already hit at least a dozen countries across Europe and the UK, raising temperatures inside freezers and chilling units and spoiling food and produce on a large scale. Several of the affected systems were remote-management units made by the Danish manufacturer Danfoss, which had already stopped shipping security updates for some of the controllers now being exploited.

In France, hackers targeted a blood bank and attempted to raise the temperature of cold-storage units holding donated blood; the attack was detected and stopped before any blood supply was compromised. In the United States, the Department of Defense is investigating a separate string of intrusions into refrigeration systems at military bases, a case first reported by the Signal and Silence newsletter and later confirmed by Reuters.

Suspicion falls on Iran

Washington has not formally attributed the campaign to any specific government or hacking group. However, security researchers have broadly pointed to Iran as the likely source, and US officials are reported to suspect the same, according to NPR and Nextgov.

“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s acting cybersecurity chief, in a statement accompanying the advisory.

What the agencies are telling operators to do

The joint advisory urges every organization that operates internet-connected refrigeration or cold-chain monitoring equipment to:

• Disconnect remote-control interfaces from the open internet wherever possible
• Change default and reused passwords on controllers and monitoring dashboards
• Apply all available vendor patches without delay
• Retire or isolate equipment that is no longer supported by its manufacturer

The campaign underscores a recurring weak point in critical-infrastructure security: industrial control systems originally built for local, isolated networks are increasingly connected to the internet for remote monitoring and convenience, often without the security hardening applied to conventional IT systems. With food distribution, blood supply chains, and military logistics now confirmed as targets in a single campaign, the incident is likely to intensify pressure on regulators and equipment manufacturers to mandate baseline security standards for operational technology.