“We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk,” FBI Cyber Branch Operations Director Brett Leatherman said in a statement.
European spree: thousands of freezers, hundreds of stores
Since mid-October, unknown miscreants have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden. According to published reports, attackers altered refrigeration settings to raise temperatures inside fridges to highs of 50ºC (122°F), spoiling food and, in some cases, sparking fires. The pattern has been disruptive enough that supermarket operators in Europe and government agencies in the United States have issued warnings and stepped up defensive guidance.
US federal advisory: FBI, CISA, HHS, Agriculture and Transportation weigh in
On Thursday, the FBI joined the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services (HHS), and the departments of Agriculture and Transportation in issuing an advisory for owners and operators of industrial refrigeration and cold-chain monitoring systems. The agencies warned that “actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.”
The advisory names the types of technical abuse investigators say they have observed or expect: bypassing authentication, injecting arbitrary code, and abusing weak configurations. The agencies note consequences that go beyond wasted inventory — attackers can change temperatures that spoil food or temperature-controlled medications, start fires, and ultimately harm people who consume improperly stored products.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageSigns in the United States: corporate outages and suspected military incidents
There are no publicly documented digital attacks against refrigeration and cold-chain monitoring systems in American supermarkets in the reporting to date. The Register reported it had not received a response from the FBI to questions about documented US incidents, and “we are not aware of any documented digital attacks against these systems in American supermarkets.” Still, there are indications that U.S.-based operators have taken the threat seriously: Dutch grocery giant Ahold Delhaize said last month it proactively took IT systems offline following a cyberattack that affected most of its US and European brands. Delhaize supermarkets in Europe are among those hit by the destructive freezer attacks, the reporting notes.
Separately, Reuters — cited in the reporting — said the Pentagon is treating a series of freezer malfunctions that spoiled food at military bases across the US in August as a suspected cyberattack, according to four officials familiar with the matter. That report has prompted federal agencies to emphasize preventive measures for both commercial and government cold-chain systems.
Operational checklist: disconnect exposed devices, patch, and harden access
The advisory lays out practical steps the government recommends be implemented “immediately.” Foremost: do not expose industrial control systems and devices to the public internet. The bulletin cites a recent precedent in which Iranian hackers used internet-accessible programmable logic controllers (PLCs) to break into more than 100 US water systems in July, underscoring how exposed devices can provide an easy route into critical systems.
- If remote access is necessary, protect it using a firewall or edge device and keep that device updated to the latest version.
- Create a dedicated VLAN for operational technology (OT) devices to isolate industrial devices from business networks.
- Replace default passwords with strong passwords and policies, and enable phishing-resistant multifactor authentication (MFA) whenever possible.
- Apply patches promptly, and retire or replace legacy devices that no longer receive manufacturer security updates.
- Define and maintain a device and IP allow-list; limit access to OT devices only to those on the list.
- Maintain and test backups kept offsite and offline, and enable logging with regular review for unusual activity.
What this means for Ahold Delhaize, the Pentagon, and US grocers
Ahold Delhaize: The company has already taken IT systems offline after a cyberattack that affected most of its US and European brands; Delhaize supermarkets in Europe were among those hit by the freezer incidents. That position places the company at the intersection of operational disruption and the need for rapid remediation.
The Pentagon: Reuters reporting that the Pentagon is treating August freezer malfunctions at military bases as a suspected cyberattack — based on four officials — raises questions about defensive posture and forensic investigation inside government-controlled cold chains.
US grocers and cold-chain operators: Although the Register found no confirmed digital attacks against American supermarkets at the time of publication, federal agencies are urging immediate application of security controls — from network isolation to offline backups — to prevent the kinds of supply losses and safety hazards now seen in Europe.
The advisory makes clear that the vector is straightforward where devices are exposed or poorly configured: unpatched, internet-accessible controllers and weak authentication are practical invitations to attackers. With tens of thousands of commercial refrigeration units running the cold chains that feed supermarkets, hospitals, and military bases, the immediate choices are concrete and technical — disconnect, patch, segregate, and log — and the consequences of delay are tangible: ruined inventory, equipment hazards, and potential harm to people and medications.
