Freezer hacking hits Europe; FBI warns US grocers

Industrial smart freezers have become an attack surface, and the US government is now telling their owners to treat them that way. In a joint advisory issued Thursday, federal agencies warned operators of commercial refrigeration and cold-chain monitoring systems that unknown attackers have been manipulating temperature settings in Europe, and urged American operators to disconnect such equipment from the public internet before the same tactics arrive stateside.

The advisory lands after a wave of destructive intrusions against grocery refrigeration in Europe. According to the FBI and partner agencies, the campaign is not a theoretical risk — the damage already done abroad is the template the government is trying to keep out of US supermarkets and warehouses.

What Europe's attackers are doing

Since mid-October, unknown miscreants have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden, according to the source reporting. The attacks push the temperature inside fridges to highs of 50ºC (122°F), which spoils food and, in some cases, sparks fires.

The advisory describes the mechanism in plain terms: the actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles. The consequences, the agencies said, can include widespread inventory loss and equipment hazards.

According to the feds, attackers gain initial access by bypassing authentication, injecting arbitrary code, and abusing weak configurations. Once inside, they can change temperatures to ruin food or temperature-controlled medications, start fires, and ultimately harm people who consume products that have not been stored at proper temperatures.

No confirmed US hits, but signs of concern

The FBI has not publicly documented successful or attempted attacks against refrigeration and cold-chain monitoring systems in the United States. No documented digital attacks against American supermarket refrigeration systems are known at this time, and the agencies did not claim otherwise in the advisory.

Still, there are indications that stateside operators are watching the issue. Dutch grocery giant Ahold Delhaize, which runs US supermarket chains Food Lion, Giant Food, and Stop & Shop, said last month it proactively took IT systems offline following a cyberattack that affected most of its US and European brands. Its Delhaize supermarkets in Europe are among those hit by the destructive freezer attacks.

Separately, the Pentagon is reportedly treating a series of freezer malfunctions that spoiled food at military bases across the US in August as a suspected cyberattack, according to Reuters, which cited four officials familiar with the matter.

The federal warning, in their words

The advisory came from the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services, and the departments of Agriculture and Transportation. It frames the threat as one that crosses sectors and borders.

“We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk,”

— Brett Leatherman, FBI Cyber Branch Operations Director

The agencies elaborated on how the intrusions unfold, describing actors who exploit unpatched or internet-accessible controllers to force units into heating and defrost cycles that can cause inventory loss and equipment hazards.

The exposed-controller problem

At the center of the advisory is a familiar operational technology weakness: devices reachable from the internet. The government's first recommendation is blunt — do not expose industrial control systems and devices to the public internet.

The source notes that Iranian hackers used internet-accessible programmable logic controllers (PLCs) to break into more than 100 US water systems in July. Exposed devices that often lack password protection are an easy entry point for intruders looking to reach critical facilities.

Where remote access is genuinely needed, the agencies advise protecting it with a firewall or edge device kept updated to the latest version, to reduce security vulnerabilities in the path into the control network.

The checklist federal agencies want followed

The advisory sets out a series of best practices that owners and operators are urged to implement immediately. The recommendations cover network segmentation, credential hygiene, patch management, access control, backup discipline, and monitoring:

• Keep industrial control systems and devices off the public internet.
• If remote access is required, front it with a firewall or edge device updated to the latest version.
• Create a dedicated VLAN for operational technology (OT) devices to isolate them from business networks.
• Replace default passwords with strong ones and turn on phishing-resistant multifactor authentication (MFA) wherever possible.
• Apply patches promptly, and retire and replace legacy devices that no longer receive security updates from the manufacturer.
• Define and maintain a device and IP allow-list, limiting access to OT devices to only those on the list.
• Maintain and test backups, keeping copies offsite and offline.
• Enable logging and review logs regularly for unusual activity.

Why cold-chain gear draws attention

Refrigeration and cold-chain monitoring systems are not incidental to a grocery operation; they govern whether food and temperature-sensitive medications remain safe. An attacker who can alter setpoints can affect inventory, equipment, and, in the worst case, the people who consume products stored outside safe temperatures.

The advisory's language reflects that reach: the agencies describe settings that force units into continuous heating and defrost cycles, with outcomes ranging from spoilage to fires. The European incidents, in which temperatures were driven to 50ºC (122°F), illustrate the physical result the government is trying to prevent.

For operators, the scale described in Europe — thousands of systems at hundreds of stores across five countries since mid-October — indicates that remote-controlled refrigeration is being treated by attackers as a target set worth probing.

What operators should take from the warning

The advisory is explicit that action should be immediate. Its recommendations are not exotic: segment OT from IT, remove default credentials, patch, maintain allow-lists, keep offline backups, and watch logs. What makes them urgent is the demonstrated willingness of attackers to reach into refrigeration controls and cause physical consequences.

Given that no US attacks have been confirmed publicly, the warning is best read as preventive. The agencies are asking operators to close the exposure that made the European incidents possible — internet-reachable controllers with weak authentication and configurations — before similar activity is documented on American systems.

The uncertainty cuts both ways for defenders. The FBI had not responded to questions about documented attacks against US refrigeration systems at the time of publication, leaving open whether such activity has occurred without public disclosure. Operators cannot wait for confirmation to act on the basics the advisory already spells out.

The stakes beyond the freezer aisle

What this suggests for businesses is that the boundary between IT security and physical safety is thinner than many operators assume. A controller reachable from the internet is not merely a data risk; in a refrigeration system, it is a lever that can spoil inventory, damage equipment, and endanger consumers of temperature-sensitive products.

The European campaign and the reported investigation of freezer malfunctions at US military bases indicate that cold-chain infrastructure is being examined as an attack target, not just an operational system. For grocery chains and other operators of industrial refrigeration, the practical takeaway is that the controls the advisory lists — isolation, credential replacement, patching, allow-listing, offline backups, and logging — are the difference between a manageable outage and a physical incident.

Whether the US sees the same tactics remains unconfirmed. What the advisory makes clear is that the government considers the risk real enough to warn the industry now, and that the defenses it recommends are within reach of any operator willing to apply them.