FBI Issues Warning As Hackers Target Grocery Store Refrigerators - Newsweek

The FBI has issued a warning over a growing wave of cyberattacks targeting industrial refrigeration systems, including those used by grocery stores and cold storage facilities.

In an alert issued on November 5, the FBI and other government agencies said malicious actors were exploiting vulnerabilities in internet-connected temperature controllers to manipulate refrigeration settings. This potentially cause food spoilage, equipment damage and significant financial losses.

"Attackers are targeting electronic temperature and refrigeration controllers, particularly in grocery stores and cold storage facilities," the FBI said. "In at least one recent incident, attackers targeted refrigeration components at three foreign blood service facilities."

The warning comes amid a wider wave of cyberattacks affecting supermarket refrigeration systems across Europe. Retailers have reported disruption linked to hackers remotely altering freezer temperatures.

Newsweek contacted the FBI via email on Friday for comment and is awaiting a response.

The advisory was posted jointly by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services, the U.S. Department of Agriculture (USDA) and the Department of Transportation. It said security weaknesses in unpatched or internet-accessible controllers can allow attackers to exploit software vulnerabilities, and weak configurations. This enables hackers to gain remote access and alter system settings.

In some cases, attackers can force units into continuous heating or defrost cycles, potentially destroying large quantities of refrigerated and frozen stock.

The agencies added that attacks could create fire hazards, disrupt temperature monitoring and indirectly endanger consumers if food is sold after being stored at unsafe temperatures.

The FBI and associated agencies are urging organizations operating refrigeration and cold-chain infrastructure to take immediate steps to reduce their exposure.

Recommendations include: removing unnecessary internet access to control systems; isolating operational technology from corporate networks; changing default passwords; and implementing multifactor authentication wherever possible.

Organizations are also advised to keep firmware updated, replace unsupported equipment, restrict access to authorized devices, and monitor systems for suspicious activity.

The advisory stresses that remote access should be secured through appropriate firewalls and other protective measures rather than exposing controller interfaces directly to the public internet.

Although the immediate focus is on grocery stores and cold-storage facilities, the warning has wider implications for healthcare, food production and transportation, where maintaining precise temperatures is critical.

The U.S. warning comes amid a series of attacks against supermarket refrigeration systems across Europe.

In October, hundreds of French supermarkets experienced attacks in which hackers reportedly manipulated refrigeration controls, causing temperatures to rise dramatically. Retailers including Carrefour and Intermarché were among those affected.

A further wave of incidents in early November affected supermarkets across several European countries, including Belgium, Sweden, Ireland, Estonia, Finland and Luxembourg.

In Ireland, refrigeration systems at 13 SuperValu stores were affected, prompting operator Musgrave to remove chilled and frozen products from sale as a precaution.

Swedish retailers ICA and Coop also reported refrigeration failures at affected stores. Belgian supermarket chain Delhaize experienced disruption across dozens of locations.

Some affected refrigeration units reportedly reached temperatures of up to 50 degrees Celsius. Retailers were forced to discard food that could no longer be considered safe.

French cybersecurity investigators identified outdated remote-control modules from Danish manufacturer Danfoss and US-based Copeland as contributing factors in the incidents. Danfoss said most affected systems were older models that no longer received software or security updates. Copeland confirmed it had identified a vulnerability in some discontinued controllers.

The attacks highlight the growing cybersecurity risks associated with operational technology (OT)—the systems used to monitor and control physical equipment and industrial processes.

Commercial refrigeration systems increasingly allow engineers to monitor temperatures and adjust settings remotely. However, when these management interfaces are exposed directly to the internet, they can become potential entry points for attackers.

Outdated software, weak passwords and unpatched vulnerabilities can make these devices particularly attractive targets.

Security researchers have previously identified vulnerabilities in refrigeration controllers, including systems supplied by Danfoss.

In 2023, researchers from HackDefense and the Dutch Institute for Vulnerability Disclosure identified three security flaws in Danish company Danfoss's AK-SM 800A controllers; these included one that allowed remote command execution and could potentially lead to full system compromise.

In August 2026, cybersecurity researchers at Claroty's Team82 published details of three further vulnerabilities in the same controller platform, including an authentication bypass and another remote code execution flaw. The vulnerabilities had been assigned CVE numbers in 2025, and Danfoss had issued firmware updates to address them.

Unlike conventional IT equipment, industrial systems may also remain in operation for years without regular security updates.

Supermarkets and other essential businesses have become increasingly reliant on connected equipment. The attacks demonstrate that even something as seemingly innocuous as a refrigerator can become a target for cybercriminals.