What happened
- CISA, the FBI and the US Departments of Agriculture, Health and Transportation issued on Thursday 5 November 2026 a joint warning about what they call an ongoing threat to industrial refrigeration equipment. TechCrunch reported it that day.
- They say attackers are compromising internet-connected refrigeration and cold chain monitoring systems in supermarkets and warehouses.
- They say the attacks reach critical infrastructure in food, agriculture, transportation and medicine shipping.
- The warning comes after several waves in the United Kingdom and Europe. Two of them made it possible to raise freezer temperatures in at least a dozen countries, spoiling food and produce.
Why it matters
- An attack on a refrigerator steals no data: it ruins food, medicine or blood. It turns a computer failure into a physical loss.
- The lesson is simple and uncomfortable: unsupported equipment stays connected to the internet and controls goods that cannot tolerate a change in temperature.
- According to the official text, attackers could force continuous heating and defrost cycles, with risks for inventory and equipment.
The number
At least 12 countries. That is the reach of the two European waves described by TechCrunch. Some of the affected systems were remote-controlled units from the Danish company Danfoss, which were no longer receiving security updates.
Context
The attackers also raised temperatures at a blood bank in France, although they were stopped before they could compromise the supplies. According to Reuters, cited by TechCrunch, the US Department of Defense is investigating attacks on freezers at military facilities.
The US government did not attribute the events to any group or country. TechCrunch says security researchers broadly attribute them to Iran and that officials reportedly suspect the same, but these are attributions without official confirmation. “Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s acting cybersecurity chief.
At Mamífero we have followed incidents in sensitive sectors. We reported that a wave of cyberattacks hit Daishin, Mirae and Bithumb in Korea and that data on more than 40,000 Homeland Security staff was published. Also that Quest Diagnostics confirmed access to patient records and that Binance blames a theft on a fake job interview.
What’s next
- The official recommendations are to take remote controls off the internet, change and strengthen passwords, apply patches and retire unsupported equipment.
- More reviews can be expected in supermarkets, warehouses and refrigerated transport, also outside the United States.
- An official attribution and a tally of the total damage are still missing.
Bottom line
Cold chains were connected to the internet to watch them better. Now several governments are asking to disconnect or protect them before a shift of a few degrees is paid for in lost merchandise.
Sources
- TechCrunch, “US government warns of ‘ongoing cyber threat’ amid mass hacks of industrial retail and military freezers”, 5 November 2026, link. This note could not read the CISA warning directly.
- Cover image: Phillip Pessar, CC BY 2.0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
