CISA, the FBI and the Departments of Agriculture, Health and Human Services, and Transportation issued a joint statement on Thursday, November 5, 2026 warning of an “ongoing cyber threat” to industrial refrigeration units, according to TechCrunch.

What the warning says

  • Hackers are targeting and compromising internet-connected refrigeration and cold chain monitoring systems in grocery stores and cold storage facilities, affecting food, agriculture, transportation and medicine shipping.
  • If exploited, attackers “could change the temperature and possibly cause physical impacts.” The agencies list fire hazards, inventory loss and shorter equipment service life. A separate fact sheet warns attackers may try to “force units into continuous heating and defrost cycles.”
  • CISA’s acting cybersecurity chief, Chris Butera, said: “Every organization that depends on refrigeration and monitoring systems should assume it could be a target.”

Equipment and incidents

  • Affected equipment includes freezers and fridges in supermarkets, US military bases and at least one blood bank, and remote-controlled refrigeration units made by the Danish company Danfoss. TechCrunch says Danfoss had ended security updates for customers’ freezers.
  • Attacks in the UK and Europe over recent weeks raised temperatures in freezers and chilling units in at least a dozen countries, spoiling thawed food and destroying produce.
  • At a French blood bank, attackers raised temperatures in cold units holding donated blood. The attack was stopped before it compromised blood stores.
  • The Department of Defense is investigating a series of hacks on military-run freezers.

Recommended steps

The agencies advise removing remote control systems from the internet, changing and strengthening passwords, applying patches where possible, and retiring equipment the vendor no longer supports.

Attribution

The US has not attributed the attacks to a specific group or government. TechCrunch says security researchers have broadly linked them to Iran and that US officials reportedly suspect Iran. The article gives no device or site counts.

Lens covered the European attacks in an earlier post.

Sources and notes

This post is based on TechCrunch’s report by Zack Whittaker (10:48 a.m. PST, November 5, 2026), which cites the joint statement, a CISA fact sheet, the BBC, Reuters and a statement from the French blood service. Lens did not read those sources and did not contact Danfoss.

Image: the control panel of industrial equipment with a touchscreen of temperature and flow readings and blue knobs, by Shixart1985 via Wikimedia Commons, licensed under CC BY 2.0; cropped. Stand-in photo; it is not related to the US government warning and does not show the events described.