Five U.S. federal agencies issued a joint advisory on November 5, 2026, warning of an “ongoing cyber threat” targeting industrial refrigeration systems. The alert from CISA, the FBI, the Department of Agriculture (USDA), the Department of Transportation (DOT), and Health and Human Services (HHS) highlights a growing trend of malicious actors manipulating internet-exposed temperature controllers to cause physical damage, food spoilage, and operational disruptions.
The warning follows a series of high-profile incidents across three continents, where attackers have moved beyond simple data theft to direct manipulation of hardware. According to the advisory, these actors are exploiting internet-accessible electronic temperature and commercial refrigeration controllers used in retail stores, cold storage facilities, and healthcare environments. By gaining remote access, hackers can force units into “continuous heating” or “defrost” modes, leading to the destruction of temperature-sensitive inventory and, in some cases, creating potential fire hazards due to abnormal heating cycles.
Military and Retail Sectors Under Attack
The scope of the threat includes critical U.S. defense infrastructure. The U.S. Army Criminal Investigation Division (CID) is currently investigating refrigeration failures that occurred in August 2026 at six domestic military bases. Among the sites impacted were Fort Huachuca in Arizona, Fort Irwin in California, and Naval Station Newport in Rhode Island. These outages raised immediate concerns regarding the security of supply chains and the storage of perishables on federal installations.
The threat is not localized to the United States. A significant “second wave” of attacks struck Europe on November 1 and 2, 2026, affecting over 115 retail locations across Belgium, Sweden, and Ireland. This followed a massive October incident in France, where more than 350 stores reported compromised refrigeration systems. Cybersecurity firm Brandefense has tracked these developments, noting that the tactics involve shifting controllers from cooling to heating, which accelerates spoilage more rapidly than a simple power outage.
Technical Vulnerabilities and Legacy Hardware
The primary targets of these attacks are legacy controllers from Danfoss. Many of these devices were connected to the internet to facilitate remote energy management and maintenance alerts but lack modern authentication protocols. Specific vulnerabilities have been identified in Danfoss AK-SM controllers, tracked as CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452, which allow for authentication bypass and remote command injection.
While the joint agency advisory attributes the activity to unidentified “malicious cyber actors,” federal authorities have not officially confirmed attribution to any specific nation-state. The focus remains on the “invisible” nature of this infrastructure; many organizations remain unaware that their refrigeration units are reachable via the public internet until an outage occurs.
Despite the high risk, there are signs of defensive improvement as organizations move to disconnect legacy hardware from the web or place it behind secure virtual private networks (VPNs).
CISA and its partner agencies recommend that any facility utilizing internet-connected temperature controllers immediately audit their exposure. Recommended mitigations include implementing multi-factor authentication (MFA) where supported, disabling remote access by default, and ensuring that any control interface is not accessible via a public IP address.
