US agencies are urging refrigeration operators to secure connected controls after cyberattacks affected European supermarkets and systems at three French blood storage sites. The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI) and three other federal agencies issued the warning on November 5. They warned that attackers could alter cooling temperatures or make equipment keep heating or defrosting, threatening supplies that depend on controlled storage conditions.
At least 17 businesses in the Netherlands, mostly butchers and small neighborhood shops, had refrigeration systems compromised when attacks reached the country on November 2. France’s national blood service separately confirmed that attackers had affected systems used to monitor and control three cold-storage locations. Employees intervened in time to protect all blood products and samples from being compromised.
Refrigeration supplier Danfoss had advised Dutch customers on October 13, following the first French attacks, to remove public internet access and use a secure network before reconnecting. A Danfoss spokesperson told NOS that most stores acted on that guidance, and major supermarket chains reportedly escaped the subsequent Dutch attacks. By contrast, Danfoss said the compromised systems retained default passwords and unsecured connections, and its spokesperson said following the precautions could have prevented the attacks.
The agencies identified weak configurations, authentication bypass flaws and code-injection vulnerabilities as potential routes into refrigeration controllers. Their recommendations include removing internet exposure from control panels and separating operational equipment from business networks. They also urged operators to replace default passwords, strengthen authentication, update firmware and retire devices that no longer receive support.
Operators should also establish safe temperature boundaries and configure alerts for readings outside them, the agencies advised. Malwarebytes recommends that home appliance owners review whether they actually need remote access and disable it if they never use the device away from home. Owners should consult manufacturer instructions first because switching off that access can also disrupt alerts or smart-home connections.
For connected appliances, Malwarebytes also advises checking who has access, including suppliers, and how that access is secured. It recommends protecting the associated app account with a strong password and enabling two-step verification when supported. Owners should update both appliance firmware and apps, enable automatic updates where offered and act on prompts requiring manual updates.
