US Warns Hospitals of Attacks on Refrigeration Systems

Cybercrime
,
Fraud Management & Cybercrime
,
Governance & Risk Management

Agencies and AHA Warn of Risks to Blood Supplies, Critical OT Systems

Marianne Kolbasuk McGee (HealthInfoSec) •
November 6, 2026    

See Also: Live Webinar | 2027 Cyber Resilience Predictions: A CISO Panel on What’s Next

The joint federal alert, issued Thursday by the Cybersecurity and Infrastructure Security Agency, FBI and the departments of Health and Human Services, Agriculture and Transportation, warns that attackers are targeting vulnerabilities in industrial refrigeration controllers and cold-chain monitoring systems.

The warning came after a wave of cyberattacks starting in mid-October disrupted European refrigeration facilities, causing hundreds of supermarkets to dump millions of euros in produce and other food due to a hacker remotely turning up the temperature in their cooling units.

Since then, the attacks have expanded, including France on Monday, when one of the refrigeration suppliers to the French Blood Establishment was hit by a cybersecurity incident (see: Refridgeration Cyberattacks Nearly Sabotage French Blood Bank).

The French blood supplier attack was thwarted by an on-call technician who noticed the temperature rise in the cold storage facilities before any blood products were affected.

Successful attacks could enable hackers to remotely change temperatures, force refrigeration equipment into continuous heating or defrost cycles, damage equipment, destroy temperature-sensitive supplies and interfere with monitoring systems, the U.S. agencies warned.

The incidents highlight growing cybersecurity risks involving operational technology, including OT that hospitals rely on for essential functions ranging from refrigeration and climate control to water systems, building security and medical equipment, said John Riggi, national adviser for cybersecurity and risk at the American Hospital Association in an interview with ISMG.

“For us, particularly in healthcare, these refrigeration systems are used to maintain the safety of the blood supply, for example. The blood supply must be kept within very tight temperature parameters,” Riggi said.

AHA Warning

The AHA issued its own advisory on Monday, ahead of the federal warning, urging hospitals to scrutinize the security of internet-connected OT, particularly refrigeration equipment.

The AHA advised hospitals to determine whether those systems need to be internet-connected, and whether unnecessary access could be eliminated.

“Do they actually need to be connected to the internet?” Riggi asked. “Could they be actually disconnected if feasible and practical to do so?”

The federal agencies warn that attackers are exploiting weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration systems. The access allows them to remotely tamper with settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.

Potential exploit methods include authentication bypass, arbitrary code injection and weak security configurations.

Besides removing unnecessary internet connections, the advisory urges organizations to strengthen authentication, update vulnerable equipment, replace unsupported legacy devices, segment OT networks and ensure temperature monitoring and alerting systems function properly.

The Food and Drug Administration also issued a separate but similar warning on Thursday about the refrigeration attack threats.

The FDA warned that recovery from such incidents could take days to months, potentially disrupting manufacturing, storage and distribution of regulated products, including blood products.

The agency urged regulated organizations to review their cold-chain infrastructure, identify security gaps and strengthen disaster recovery and continuity plans.

Legacy Device Risk

Riggi said the expanding use of internet-connected OT in hospitals has improved efficiency but also created additional opportunities for attackers.

“There’s a problem, though not just the new equipment, it’s the legacy OT equipment that may have been internet-connected or network-connected for a very long time,” he said.

Some older equipment was connected to networks before cybersecurity protections were common or even available, potentially leaving them exposed to attackers, he said.

Riggi also warned that hospitals may lack visibility into some operational systems because facilities departments sometimes acquire and deploy equipment without involving cybersecurity teams.

“And there may not be a manual override for these systems either, so they’re totally digitally dependent,” he told ISMG. “The problem is that they’ve now created many, many additional access points to hospitals’ networks, which may or may not be visible to the cybersecurity team.”

Scott Gee, deputy national adviser for cybersecurity and risk at the AHA, said hospitals must address a longstanding disconnect between facilities management personnel and cybersecurity teams to better protect OT.

“It’s critical that people have a comprehensive inventory of that operational technology that’s riding on their network, and understand any vulnerabilities that are present in that,” Gee told ISMG.

The AHA also recently issued an earlier warning involving vulnerabilities in a programmable logic controller, or PLC, a device commonly used to automate and manage functions such as climate control and water regulation, Gee said.

Hospitals need to understand not only which operational systems are connected to their networks but also the security posture of those devices, he said.

“Make sure that only stuff that has to be on the network is on the network, and that part of the network is segmented and controlled appropriately,” Gee advised.

Just hardening access to these systems is not enough, said Marc Josephson, CEO at security firm CORIS Monitoring.

“When systems are compromised, you cannot rely on them to send alerts about out-of-normal operations,” he said. “In the case of the refrigerators, it is highly likely that under normal conditions the maintenance interface would send alerts about abnormal operation. But when that interface is compromised, the alert path is likely also compromised,” he added.

The best practice would be to utilize external monitoring systems that provide an external and persistent means of alerting – thereby enabling quick response, he said.

Other Attacks

The latest attack concerns extend beyond refrigeration and other hospital-owned equipment to the utilities and third-party service providers that hospitals and other healthcare organizations rely on, Riggi said.

Riggi cited recent Iranian government-linked cyberattacks involving publicly accessible, insecure programmable logic controllers used in water infrastructure (see: Attackers Targeted Over 100 U.S. Water Systems in July Hacks).

Similar equipment is present in hospitals, creating risks not only from direct attacks but also from disruptions affecting utilities and other interconnected critical infrastructure, he said.

“We have to think about if we lost a utility as well, or the utility was the access to hospital networks via some type of connection, we have to be prepared for that,” Riggi said.

To date, U.S. federal authorities have not confirmed whether any U.S. blood collection or storage facilities have been affected by the recent refrigeration system attacks.

But this is not the first time that authorities have warned of cyberattacks affecting blood supply organizations.

In 2024, the FDA urged blood suppliers to bolster their cybersecurity practices to prevent and mitigate cyber incidents that could affect the availability and safety of critical blood and blood components used for transfusions and other patient care. That warning came in wake of several high-profile ransomware attacks affecting blood organizations in the U.S. and elsewhere.

That included an attack on Synnovis, a British pathology laboratory services provider that disrupted patient care and testing services at a number of London-based National Health System hospitals and other care facilities for several weeks, and led to a nationwide shortage of type-O blood supplies in the United Kingdom for months (see: FDA Urges Blood Suppliers to Beef Up Cyber).

As for the recent rash of refrigeration system attacks, all critical infrastructure operators must remember that any connected device could be considered an entry point for bad actors, said Josephson.

“OT systems are typically connected to save time or to simplify management,” he said. “There can be a lack of foresight in recognizing the risk because ‘who would want to attack a freezer?’ This same situation applies across many OT systems that can sneak below the radar of cybersecurity defenses which are more attuned to IT threats,” he said.

“Other mechanical and supporting OT systems such as HVAC could also be at risk unless strong protections are in place and security measures are kept up to date.”