Hospitals Warned of Potential Cyberattacks on Refrigeration and Freezer Systems
Hospitals and other critical infrastructure entities in the United States have been warned that internet-connected refrigeration and freezer systems could be targeted by threat actors, as they have been in Europe. Starting in mid-October, hackers started targeting internet-connected industrial refrigeration, freezer, and cold chain monitoring systems. The hackers remotely altered temperature control settings, causing hazardous temperature increases. These attacks pose a fire risk, have resulted in loss of inventory, and have the potential to change the service life of an affected system.
In Europe, there have been two waves of attacks; the first started in mid-October and affected refrigeration controllers in France. Hackers remotely accessed control systems and activated defrost functions in refrigerators and freezers. An estimated 250 to 350 French supermarkets were affected, resulting in significant food waste and financial losses. In these attacks, the hackers targeted older versions of control software from the company Danfoss, which had stopped issuing security updates for the affected software.
Then came a second wave of attacks in early November, affecting refrigeration and freezer systems in six European countries. On November 3, 2026, the French Blood bank EFS confirmed that it had been affected. Refrigeration systems that kept blood products at -30°C (-22°F) had their temperature parameters altered, with some cold storage rooms reaching 110°C (230°F). Fortunately, the increase in temperature was identified by an on-call technician who was able to take action to prevent loss of inventory. In this attack, the industrial control software was maintained by the Dutch temperature control rental company Coolworld. Coolworld confirmed that only a limited number of units were affected, and that the vulnerability exploited related to a third-party component that was not directly under its control.
Last week, a joint cybersecurity alert was issued by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation, the Department of Health and Human Services, and the Departments of Agriculture and Transportation, warning critical infrastructure entities in the United States that hackers are actively targeting vulnerabilities in internet-accessible temperature control systems. While the attacks appear to have only involved systems in Europe, there is concern that they could spread to the United States.
All critical infrastructure entities that rely on refrigeration and freezer systems have been urged to disconnect those systems from the Internet. In some of the attacks in Europe, hackers had exploited default passwords to gain access to control systems. All default passwords should be changed, and security updates and patches should be applied promptly to prevent exploitation. The alert also advises isolating operational technology from business networks and enforcing safe temperature limits. The American Hospital Association (AHA) also issued a warning about potential attacks, urging members to assess whether temperature control systems need to be internet-accessible, and to disconnect them from the Internet if possible and practical to do so.
