A strawberry ice cream pop melting on a white background, with the CISA seal at right

FBI, CISA and USDA Warn Grocery Stores That Hackers Are Targeting Refrigeration Controllers

A Nov. 5 federal fact sheet says attackers are going after the controllers that run grocery and cold storage refrigeration. The Pentagon is investigating freezer failures at military commissaries as a possible cyberattack.

Five federal agencies have warned that hackers are targeting the controllers that run refrigeration in grocery stores and cold storage warehouses. The Nov. 5 fact sheet comes after freezer attacks on supermarkets in Europe and suspected attacks on U.S. military commissaries.

TLDR

  • The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the U.S. Department of Agriculture (USDA), the Department of Health and Human Services (HHS) and the Department of Transportation (DOT) issued the warning together.
  • The agencies say attackers may force units into continuous heating and defrost cycles, spoiling inventory.
  • They list a risk that people could be harmed if food is eaten after unsafe storage.
  • The fact sheet does not name the attackers.

What the Agencies Said

The fact sheet says malicious actors are targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. They may exploit unpatched controllers or ones reachable from the internet, the agencies wrote.

The listed methods are authentication bypass, code injection and weak configurations. Once inside, an attacker could change temperatures. The agencies say that could shorten equipment life, create a fire hazard, cause inventory loss or indirectly harm consumers. An attacker could also cut off the operator’s view of current temperatures.

Health care, chemical, food and agriculture, and transportation organizations use the same systems, including in refrigerated transport, according to the fact sheet. They run temperature logging, defrost cycles and energy management.

What Operators Are Told to Do

The agencies urge owners to take refrigeration controllers off the public internet and to put them on a network separate from business systems. They also call for changing default passwords, using multifactor authentication and keeping firmware updated. Devices that no longer receive updates should be retired and replaced.

Operators are also told to set limits on how far temperature setpoints can move and to set alerts when readings drift outside safe ranges.

The Commissaries and Europe

The Pentagon is treating freezer malfunctions at U.S. military commissaries as possible cyberattacks, Reuters first reported. Nextgov/FCW reported that the incidents began around late August and affected roughly six commissaries, the grocery stores on military bases. The Army Criminal Investigation Division told Reuters its Cyber Field Office is working with French law enforcement, according to Food Safety Magazine.

In October, attackers hit refrigeration at hundreds of establishments in France, Nextgov/FCW reported. CNBC reported that the French attack caused tens of millions of euros in damage. A new wave hit stores in Sweden, Belgium, Luxembourg and elsewhere on Monday, Nov. 2, Nextgov/FCW and CNBC reported. No one has publicly claimed responsibility, and the U.S. agencies did not say whether the incidents are linked.

Why It Matters

Cold storage is a food safety control. The fact sheet lists possible harm to consumers alongside equipment damage. USDA and HHS signed it alongside the security agencies. Grocery chains and cold storage operators now have a federal checklist, including retiring controllers that no longer receive updates.

Sources: CISA, FBI, HHS, USDA and DOT fact sheet (Nov. 5, 2026); CNBC; Nextgov/FCW; Food Safety Magazine.