FBI, CISA Warn Supermarkets: Internet-Exposed Refrigeration Is a Hacker Target

Hackers pushed supermarket refrigeration systems in France to 120 degrees Fahrenheit, causing fires, spoiled food and millions of dollars in damage — and on Thursday, U.S. federal agencies told domestic operators to make sure it doesn't happen here.

The Cybersecurity and Infrastructure Security Agency and the FBI issued a joint statement warning of "malicious cyber activity" targeting industrial refrigeration systems. The USDA, the Department of Health and Human Services and the Department of Transportation — the three agencies overseeing sectors that lean heavily on industrial refrigeration and cold chain monitoring — co-signed the advisory.

The warning is not theoretical. Since early October, European refrigeration equipment has taken at least three distinct hits, as documented by sister publication Cybersecurity Dive.

• Hackers gained access to programmable controllers regulating commercial refrigeration at hundreds of grocery stores across France, raising temperatures to 120 degrees Fahrenheit. The result: fires, spoiled inventory and damage in the millions of dollars.
• Weeks later, a second wave hit dozens of internet-exposed refrigeration devices at major grocery chains across multiple European countries, with attackers resetting controls to defrost.
• A separate attack targeted the French Blood Establishment, which manages the country's blood supply. An unknown hacker manipulated temperature controls in cold storage rooms at three of the organization's sites.

What exactly can go wrong?

The advisory lays out the failure modes plainly. Hackers who reach internet-accessible refrigeration and cold chain monitoring systems can alter temperatures, creating fire hazards and widespread inventory loss. They can also indirectly harm consumers who eat a product stored at unsafe temperatures. And they can strip operators of visibility into current temperatures altogether — which means a retailer might not learn food sat too warm until someone gets sick.

For grocers, that's a food safety liability stacked on top of an equipment and shrink problem. A single compromised controller can torch a case of product; a coordinated campaign can torch a supply chain's credibility.

What does the government want operators to do?

The agencies urge owners and operators to act "immediately" on several fronts:

• Do not connect control system devices to the public internet.
• Keep device firmware updated.
• Report unexpected activity.

None of this requires new spending on exotic tools. It requires discipline — the unglamorous kind of hygiene that keeps a walk-in freezer off Shodan and out of the news.

The practical question for U.S. retailers is what changes this week. The answer: anything with a network card and a compressor now belongs in the same security conversation as the point-of-sale system. The French incidents proved the attack path works at scale, and the joint advisory signals that federal regulators expect cold chain operators to close it before someone replicates the exercise stateside.