U.S. Agencies Warn of Attacks on Industrial Refrigeration Systems

United States government agencies, including CISA and the FBI, have issued a joint advisory warning that cyber actors are actively targeting internet-accessible industrial refrigeration and cold-chain monitoring systems worldwide. Threat actors are exploiting unpatched controllers, authentication bypasses, and weak configurations to alter temperature settings, triggering fire hazards, defrost cycles, and inventory spoilage. Attacks have already disrupted hundreds of European grocers and compromised plasma storage at the French Blood Establishment. Malaysian organisations encountering suspicious operational technology activity should report incidents directly to the National Cyber Coordination and Command Centre via Cyber999 (MyCERT).

Key Facts

How Are Attackers Exploiting Refrigeration Controllers?

Threat actors are exploiting authentication bypasses, arbitrary code injection, and weak configurations in unpatched, internet-exposed controllers. Once inside, intruders remotely alter operational settings, forcing refrigeration units into continuous heating or defrost cycles. These manipulations trigger severe equipment overheating, fire hazards, inventory loss, and complete denial-of-service visibility over current cooling temperatures.

According to the joint advisory released by the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Health and Human Services (HHS), Department of Agriculture (USDA), and Department of Transportation (DOT), these intrusions deliberately target operational systems safeguarding food, medicine, and critical supplies. In several documented European attacks, threat actors manipulated cooling units to reach temperatures as high as 50 degrees Celsius (122 degrees Fahrenheit) or locked units into persistent defrost states, destroying stored perishables.

Threat actors exploit internet-accessible controllers to force cooling equipment into continuous heating cycles that risk fires and product spoilage.

Which Organisations Have Been Impacted So Far?

Attacks have compromised hundreds of supermarkets, butchers, and grocers across twelve European countries, alongside critical healthcare infrastructure. A breach at an equipment provider notably impacted the French Blood Establishment, driving plasma storage temperatures to extreme levels. Censys observed widespread exposure across Danfoss StoreView and Copeland/Dixell XWEB systems globally.

The campaign in Europe affected major supermarket chains as well as small retailers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the United Kingdom. Censys data revealed that exposed Danfoss StoreView instances dropped from 3,004 to 708 between 9 October and 5 November 2026, while Copeland/Dixell XWEB exposure declined from 3,708 to 2,420. Censys noted that Asia's share of global industrial control system exposure grew from 22 percent in 2024 to 25 percent in 2026. The threat actors responsible have not been identified.

European grocers and three blood plasma storage facilities in France suffered temperature tampering following cyber intrusions into exposed refrigeration hardware.

What Should You Do?

Specific software patch versions were not specified in the advisory; operators should verify updates directly with equipment manufacturers and implement the following hardening measures:

• Identify and audit all cold-chain monitoring systems and controllers accessible from the public internet.
• Isolate operational technology (OT) devices from corporate IT networks and the wider internet.
• Change default passwords immediately and enforce strong authentication across all control interfaces.
• Remove unnecessary remote access pathways and secure all required connections.
• Keep controllers updated with current firmware, and retire or replace unsupported legacy equipment.

Common Questions

Who is carrying out these refrigeration attacks?

The advisory and security researchers have not identified the perpetrators behind the intrusions. Official statements from U.S. agencies and incident reports from affected European organisations confirm active attacks across critical infrastructure sectors globally, but attribution currently remains unconfirmed.

What physical risks do compromised cooling controllers present?

Attackers can remotely trigger continuous heating and defrost cycles, raising unit temperatures up to 50 degrees Celsius. This manipulation causes severe food and medical spoilage, creates potential fire hazards from overheating machinery, shortens equipment service life, and blinds operators to real-time temperature telemetry.

Which controller models are known to be exposed online?

Attack surface data from Censys highlights Danfoss StoreView and Copeland/Dixell XWEB interfaces as widely exposed on the internet. Although exposed instances decreased between October and November 2026, thousands of systems remain accessible, with Asia accounting for 25 percent of global industrial control exposure.

Sources and Methodology

This news dispatch is based solely on reporting published by The Hacker News on 9 November 2026. ROCKSTARmedia Infosec has not independently verified or consulted secondary advisories, manufacturer portals, or third-party documentation for this report.