US agencies warn hospitals to harden refrigeration systems after cyberattacks

On Thursday, November 5, 2026, CISA, the FBI and the departments of Health and Human Services, Agriculture and Transportation issued a joint fact sheet stating the federal government is "aware of malicious cyber actors targeting industrial refrigeration and cold chain monitoring systems globally". The agencies urged healthcare organizations and critical infrastructure operators to strengthen protections for internet-connected refrigeration systems that keep blood supplies and medication safe.

The European wave began in mid-October, when attackers remotely raised temperatures in supermarket cooling units, forcing hundreds of stores to discard millions of euros in food. On Monday, a refrigeration supplier to the French Blood Establishment was hit, and the attack was stopped only when an on-call technician noticed a temperature rise before blood products were damaged. The French Blood Establishment confirmed in a Tuesday press release that a vendor for its cold storage rooms was targeted and that defrost and temperature thresholds were raised dangerously high; it detected the suspicious activity in time to rescue blood samples.

The federal agencies warned that successful attacks could let hackers alter temperatures remotely, make units run constant heating or defrost cycles, harm equipment, ruin temperature-sensitive products and interfere with monitoring. The alert said attackers could use authentication bypass, arbitrary code injection or weak security settings to gain access.

The American Hospital Association issued its own advisory on Monday, telling hospitals to determine whether refrigeration systems need internet access and to disconnect them where feasible. The FDA warned on Thursday that recovery from these incidents could last days to months and told regulated organizations to examine their cold-chain systems and improve disaster recovery and continuity plans. Health ISAC's bulletin urged hospitals to separate refrigeration controllers and medical gas monitors from hospital IT systems, train staff to take physical manual control in an emergency, and keep offline backups, NPR reported.

It remains unclear who is responsible for the attacks, NPR reported on Friday. NPR reported that Iran was tied to an earlier spring incident in Israel, and investigators looking into the U.S. base disruptions are eying Iran as a possible culprit. The Pentagon also said last week it was looking into recent freezer problems at six commissaries on U.S. military bases, but it is not known if those events are connected, Politico reported. Two pro-Russian groups, NoName057(16) and Z-Pentest Alliance, released videos claiming responsibility for the European incidents and posted alleged stolen credentials for Danfoss and Copeland equipment, but some cybersecurity experts are skeptical because the attacks may not have required stolen credentials. Tom Hegel of SentinelOne told NPR that "Russian-aligned actors are a credible hypothesis because there is a credible precedent," but he said that is "only the context, not the missing evidentiary link to these European incidents".

Researchers cited by NPR found thousands of Danfoss refrigeration controllers in France exposed to the open internet with little protection before the October attacks. Claroty published research on vulnerabilities in controllers made by Copeland and Danfoss, and the vendors designed patches, but experts say operational technology is difficult to patch because shutdowns create patient-safety risk and some aging models can no longer be patched. Nic Adams of 0rcus told NPR that vendor contracts often "mandate persistent remote access," leaving food and medical supplies open to credential abuse.

Health ISAC and the AHA said defenders should first remove unnecessary internet connections, segment operational technology from enterprise and guest networks, and maintain an inventory of devices on hospital networks. CISA's guidance also calls for stronger authentication, patching vulnerable gear, replacing legacy devices no longer supported, and confirming temperature monitoring and alerts work properly.