FBI warns of global refrigeration cyberattacks after retail hits

By Tom Whitfield

Refrigerators and freezers at Ahold Delhaize and several other European supermarket operators reached about 120 degrees overnight in at least two separate attacks in October 2026, according to incidents cited in the FBI’s Nov. 9 warning. The advisory did not disclose affected-store counts, refrigerated-unit counts, inventory value, financial losses or recovery costs.

Three national blood-service facilities in France were targeted during the week before the warning. Alarms alerted staff in time, and no blood was lost, FBI assistant director and head of cyber investigations Brett Leatherman said. The warning did not publicly link the blood-service incidents to the supermarket actors.

“Attackers are getting in through controllers that are unpatched, reachable from the internet or still using the default passwords listed in the manufacturer’s manual,” Leatherman said. His wording identifies access conditions, not the number of exposed controllers or compromised systems.

The warning followed supermarket attacks in France and several other European countries during October and the targeting of three French blood-service facilities. The FBI issued it with the Cybersecurity and Infrastructure Security Agency, Department of Justice, U.S. Department of Health and Human Services, U.S. Department of Agriculture and U.S. Department of Transportation.

The agencies said they were aware of “malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally.” Cold chain means temperature-controlled transport and storage. They offered no country list, controller count or loss total, and the warning did not publicly link every incident to one actor.

What should cold-chain operators change now?

Owners and operators in industries that rely on cold-chain transport and storage should use strong authentication (methods that verify approved users), keep systems updated, identify internet-accessible equipment and remove unnecessary remote access. Leatherman translated those controls into five actions involving refrigeration controllers (devices governing cooling equipment):

• Take refrigeration controllers off the public internet.
• Put required remote access behind a firewall, a barrier that filters network traffic.
• Change default passwords, including those retained from manufacturers’ manuals.
• Understand how vendors configure each device.
• Set safe temperature limits and ensure alerts reach the appropriate staff.

The stated entry methods were authentication bypass (circumventing access controls), arbitrary code injection (inserting code into a system) and weak configurations. After gaining access, hackers could force continuous heating and defrost cycles or obscure current temperatures.

The agencies said these actions could damage equipment, create fire hazards, cause inventory losses and indirectly harm consumers who later consume products stored unsafely. They presented those as possible outcomes, not as a documented loss total across all affected installations.

Danfoss, described as a software provider whose systems were targeted in both supermarket attacks, recommended disconnecting from the internet the week before the warning. Danfoss was working with grocers to develop a better safeguard. The source did not specify the safeguard, affected product lines, deployment numbers or whether grocers implemented the disconnection.

For grocers and any cold-chain distributor serving them, refrigeration failure can strand saleable stock and interrupt orders. Spoilage or disposal removes gross profit dollars and can pressure gross margin (sales less product cost), while stock awaiting disposal or replacement can worsen inventory turns (how often stock sells and is replaced). Emergency service, disposal and replacement costs could compound the margin effect, although the advisory quantified none.

No affected cold-chain distributor, wholesale shipment or supplier-contract change was disclosed, so the report shows no measured shift in channel power (bargaining strength among grocers, distributors and vendors). A grocer’s need for urgent vendor configuration could affect negotiations, but the source provides no pricing, contract or volume data to establish that effect.

For customers, refrigeration compromise combines availability with safety. Unsafe storage could harm consumers who later consume affected products, while a prolonged shutdown could reduce shelf availability. The blood-service alarms produced a measured favorable outcome—staff warning and no lost blood—but the source disclosed no comparable containment result for supermarkets.

No platform or marketplace transaction data appears in the advisory, so readers cannot test its global warning against order, sales or payment volumes. Nor is there a denominator for exposed controllers.

The documented record consists of at least two supermarket system intrusions, three French blood-service targets, about 120-degree refrigeration conditions and no reported blood loss. Wider global activity and consumer harm remain agency assessments and stated risks.

The forward test is whether grocers, blood services and other cold-chain operators can remove public exposure while preserving temperature visibility and routing alerts to accountable staff. Until agencies disclose controller counts, retail inventory write-offs and financial losses, the gross-margin and inventory-turn effects remain unquantified. The next proof point is containment: exposed controllers removed, safe limits configured and alerts reaching the right staff before forced heating becomes inventory loss.