When the Refrigerator Becomes the Attack Surface: Cyber Risk to the 2–8 °C Pharmaceutical Cold Chain in Health Care

Between 11 October and 3 November 2026, internet-exposed refrigeration controllers were manipulated at supermarkets in at least nine European countries, and the US Department of Defense began investigating similar freezer failures at military commissaries. Equivalent supervisory equipment is used to hold vaccines, biologics, and blood-bank reagents in hospitals and pharmaceutical warehouses. This article describes the incidents and the vulnerability behind them, summarizes what is known about who acted and why, and translates the findings into consequences and controls for health care. It is a narrative review of national cybersecurity alerts, vendor advisories, internet-exposure scan reports, and news reporting published between August and November 2026, combined with an illustrative loss model. Scans identified 12,976 internet-exposed refrigeration management services on 6,017 addresses in 99 countries. Attackers needed only ordinary supervisory functions (setpoints, defrost, alarm suppression), exploiting flaws for which fixes had been available for a year or more, and a laboratory demonstration held the display at a normal reading while cooling was disabled. No group has claimed responsibility and no ransom has been demanded. The exposure lies in the control layer, not the refrigerator, and the temperature record that would normally settle a batch-disposition decision resides on the device that was manipulated, converting a refrigeration fault into a data-integrity event. Health care organizations and their suppliers should treat any internet-reachable controller as compromised, verify reachability by external scanning, remove it before patching, and pair every critical store with independent monitoring. Cold storage in health care merits treatment as critical infrastructure.