CISA and FBI warn of cyberattacks tampering with industrial cooling systems

Key facts

European retail wave and 11-nation geographic spread

On Thursday 5 November 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint cybersecurity alert urging operators of temperature-controlled critical infrastructure to review and secure their industrial cooling assets. The advisory follows coordinated cyberattacks that systematically targeted commercial refrigeration systems across Western, Northern, and Southern Europe.

Perpetrators identified internet-facing refrigeration controllers and building automation gateways at hundreds of retail grocery stores across 11 European nations. By gaining unauthorized administrative access, the attackers overrode standard thermostat settings and forced cooling units into sustained defrost and heating modes. The resulting thermal spikes caused extensive inventory spoilage, with commercial damages estimated in the millions of euros.

Zoom

Documented cold-chain cyber incident footprint across impacted regions

Geographic Region	Impacted Countries	Targeted Facility Types	Primary Operational Consequence
Western Europe	France, Germany, UK, Belgium, Netherlands, Luxembourg, Ireland	Supermarkets, distribution hubs, blood banks	Inventory spoilage, compressor thermal strain
Northern Europe	Sweden, Finland, Estonia	Commercial grocery chains, regional cold storage	Widespread perishable inventory loss
Southern Europe	Portugal	Commercial refrigeration and cold logistics	Forced defrost cycles and temperature excursions
North America	United States	Department of Defense military commissaries	Uncommanded heating switches under DoD IG review

European cybersecurity authorities, including the United Kingdom National Cyber Security Centre and Belgium's national cyber agency, confirmed active investigations into the disruptions. While official attribution has not been publicly declared, intelligence services are evaluating hybrid warfare and industrial sabotage hypotheses amid heightened geopolitical friction.

Healthcare cold chains: French blood bank tampering

The campaign expanded beyond commercial retail into public health infrastructure when attackers breached environmental monitoring systems at the French Blood Establishment (Etablissement Francais du Sang, EFS). EFS confirmed that unauthorized actors altered temperature settings and defrost thresholds to extreme levels at three separate regional cold storage facilities.

The targeted cold rooms stored critical national reserves of whole blood, red cell concentrates, and frozen plasma products, which require continuous temperature maintenance between 2 and 6 degrees Celsius for liquid fractions and minus 25 degrees Celsius or lower for frozen plasma. Fortunately, secondary acoustic alarms and out-of-band monitoring sensors alerted facility engineering staff immediately. Operators manually overrode digital controllers and shifted sensitive biological inventory to redundant backup refrigeration units, successfully preventing any loss of blood products.

Attack mechanics and programmable logic controller exploitation

The technical advisory from CISA and the FBI highlighted that modern industrial cooling systems rely heavily on automated digital controllers for continuous temperature telemetry, remote diagnostic monitoring, and energy optimization. When these controllers are directly exposed to the public internet, they provide threat actors with an unauthenticated or weakly authenticated bridge into physical facility operations.

Zoom

Attackers conduct automated port scans targeting default industrial automation ports, including Modbus TCP (port 502), BACnet/IP (port 47808), and embedded web servers hosted directly on controller hardware. Upon establishing access, attackers do not deploy ransomware encryptors; instead, they execute legitimate operational technology commands to adjust high-temperature alarm thresholds upward, suppressing warning notifications. They then trigger continuous electric defrost cycles, turning cooling units into heating elements.

Operational technology attack vectors and physical system impacts

Attack Stage	Technical Method	Attacker Objective	Physical Consequence
Discovery	Public IPv4 port scanning	Locate exposed BMS, RTU, and PLC gateways	Zero barrier to perimeter entry
Access	Exploit default vendor credentials	Gain administrative control without exploit code	Complete supervisory authorization
Parameter Tampering	Modify Modbus/BACnet holding registers	Suppress alarms and alter high-limit tripwires	Blinds centralized monitoring software
Physical Disruption	Command permanent defrost cycle	Engage electric heater strips and halt compressors	Thermal degradation of stored perishables

Cross-sector exposure and mandatory hardening controls

In the United States, the Department of Defense Office of the Inspector General is investigating unexplained freezer heating switches at several military commissaries that occurred in August 2026. The 96-day interval between the initial commissary anomalies and the 5 November joint advisory (derived) reflects an expanding federal effort to quantify cold-chain exposure across strategic national sectors.

Zoom

Mandatory defensive controls for temperature-controlled infrastructure

Defensive Layer	Specific Technical Requirement	Target Failure Mode	Implementation Priority
Perimeter Isolation	Remove all PLC, RTU, and BMS interfaces from public internet routing	Direct internet enumeration and unauthenticated remote access	Immediate (Priority 1)
Access Governance	Enforce phishing-resistant MFA on all contractor VPNs; disable shared vendor accounts	Contractor supply chain compromise and credential reuse	Immediate (Priority 1)
Out-of-Band Telemetry	Install independent hardwired thermal sensors with cellular or local acoustic sirens	Sensor spoofing and suppression of centralized BMS alarms	Immediate (Priority 1)
Logic Integrity Audits	Implement configuration change logging and periodic register verification on PLCs	Silent parameter tampering and unauthorized defrost overrides	Short-term (Priority 2)

CISA and the FBI emphasized that critical infrastructure asset owners must treat building management systems and industrial refrigeration controllers as primary mission-critical assets. In an environment where cyber adversaries exploit physical kinetic effects to cause economic and social harm, physical out-of-band monitoring and strict network segmentation represent the baseline standard of care.