US issues eight defenses against hackers who make cold rooms heat up

On October 12, CERT-FR (France's national computer emergency response team) issued an alert about a "security incident targeting remote controllers of refrigeration systems." In France, hundreds of supermarkets had just seen their refrigerators thrown off. On November 5, it was the United States' turn. CISA, the federal cybersecurity agency, the FBI and three departments (Health, Agriculture and Transportation) published a joint fact sheet. It calls for "hardening" industrial refrigeration and cold chain monitoring systems.

The document names neither France, nor a manufacturer, nor a hacker group. The agencies say only that they are aware of malicious activity targeting this equipment "worldwide." The targets are electronic temperature regulators and commercial refrigeration controllers in supermarkets and cold storage warehouses. They are also found in healthcare, chemicals, food processing and refrigerated transport.

Refrigerators that can be made to heat up remotely

The scenario described resembles what French stores experienced. According to the fact sheet, hackers could take advantage of controllers exposed to the Internet or left unpatched to change their settings remotely. For example, they could force refrigerated display cases into continuous heating and defrost cycles. According to the agencies, this could cause large-scale stock losses and risks to equipment. The document also mentions premature equipment wear, fire risks, indirect consequences for consumers and the loss of all visibility into actual temperatures.

To get in, attackers could use several routes: the agencies cite authentication bypass, code injection and weak configurations. In France, CERT-FR had in fact published an alert on Danfoss AK-SM and AK-SC controllers, and ANSSI (France's national cybersecurity agency) had found that weak passwords had been enough to hack supermarket refrigerators.

The eight measures to apply in your stores and warehouses

If weak passwords were enough in France, the defenses are nothing exotic. They apply to a supermarket as well as to a pharmacy, a laboratory or a logistics warehouse:

1. Take controllers off the Internet. If remote access is essential, protect it behind a firewall or an up-to-date edge device.
2. Isolate this equipment on a network dedicated to industrial systems, separate from the office network.
3. Change default passwords, require strong passwords and, if possible, phishing-resistant two-factor authentication.
4. Update firmware and replace end-of-life devices.
5. Restrict access to authorized devices and IP addresses only.
6. Keep recent backups, offsite and offline, and test them.
7. Monitor: enable logs and review them regularly or, failing that, record network traffic between devices.
8. Cap temperature setpoints within reasonable ranges and trigger an alert when readings deviate.

The last measure is the most concrete. Even if an intruder took control of a controller, well-set setpoint limits and an alert on deviations could prevent tons of goods from being lost before anyone notices.

Who is behind these attacks?

The question remains unanswered: the U.S. fact sheet names no one responsible and does not say whether sites in the United States were hit. It does ask that any incident be reported to CISA and the FBI. Incidents affecting the healthcare supply chain should be reported to the Department of Health. The coming weeks will show whether new victims come forward.

Update of November 12, 2026

The attacks that disrupted the refrigerators of more than 700 French supermarkets now have a named perpetrator. On November 9, the Ministry for Europe and Foreign Affairs attributed the campaign of the night of October 11 to 12 to Shahid Kaveh. It is an offensive cyber unit attached to the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps, the ideological army of the Iranian regime. France condemns "unacceptable cyberattacks" in the statement. According to the statement, they caused fires, material damage and food losses estimated at several tens of millions of euros. Paris sees it as the first cyber campaign conducted on national soil purely for sabotage.

The attribution is based on work carried out within the C4, the cyber crisis coordination center. It brings together, among others, the French national cybersecurity agency (ANSSI), the Directorate General for External Security (DGSE) and the Directorate General for Internal Security (DGSI). According to BleepingComputer, the attack was relayed by CyberbanNews, a propaganda outlet that France associates with this unit. Shahid Kaveh also operates under the identities of purported hacktivists, such as CyberAveng3rs. France will summon Iran's ambassador and will propose new European sanctions to its partners.

This attribution covers only the October wave. The one that hit more than 115 stores in at least eleven European countries in early November has not been attributed, BleepingComputer notes. The November 5 U.S. fact sheet, for its part, named no perpetrator.