U.S. Agencies Warn of Attacks on Industrial Refrigeration Controllers
Summary
U.S. agencies warn that attackers are targeting internet-accessible refrigeration controllers. Attacks disrupted supermarket cooling in Europe, and a French blood-storage provider incident affected three facilities; the attackers remain unidentified.
Key points
- A joint advisory from CISA, FBI, HHS, USDA, and DOT warns of global targeting of industrial refrigeration and cold-chain monitoring systems.
- The advisory says attackers may exploit authentication bypasses, arbitrary code injection, or weak configurations in unpatched or internet-accessible controllers.
- Recent attacks disrupted refrigeration at hundreds of supermarkets across Europe, spoiling food and causing financial losses.
- The French Blood Establishment confirmed a refrigeration-provider incident that raised temperature and defrost settings at three blood-plasma storage facilities; the responsible actors are unknown.
- The agencies urge operators to use strong authentication, update systems, restrict internet exposure and remote access, isolate OT devices, change default passwords, and replace legacy equipment.
- Censys reported exposed Danfoss StoreView instances fell from 3,004 to 708 between October 9 and November 5, 2026; exposed Copeland/Dixell XWEB instances fell from 3,708 to 2,420.
Article Details
- Event Type
- U.S. agencies issued a joint warning that threat actors are targeting industrial refrigeration and cold-chain monitoring systems globally.
- Impact
- Reported attacks on hundreds of European supermarkets raised refrigeration temperatures or forced units into defrost mode, spoiling food and causing financial losses. The French Blood Establishment confirmed that an incident affecting a refrigeration equipment provider raised temperature and defrost settings at three facilities storing blood plasma. The advisory warns that such activity could also cause service disruptions, fire hazards, and equipment damage. The article says it is unclear who is behind the attacks.
People
Products
Copeland/Dixell XWEBthe number has dropped significantly from 3,004 to 708 between October 9 and November 5, 2026. The Copeland/Dixell XWEB exposure, likewise, has declined from 3,708 to 2,420.Danfoss StoreViewData from Censys shows that there are still hundreds of Danfoss StoreView instances exposed globally, with most of them located in France, although the number has dropped significantly from 3,004 to 708 between October
Countries
BelgiumTargets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.EstoniaTargets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.FinlandTargets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.FranceTargets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.GermanyTargets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.IrelandTargets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.ItalyTargets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.LuxembourgTargets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.PortugalTargets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.SwedenTargets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.the NetherlandsTargets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.the U.K.Targets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K.