CISA, FBI and US agencies warn of attacks on internet-exposed industrial refrigeration and cold-chain systems, Iran suspected
Matéria consolidada. Reúne 5 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 06/11/2026 00:02; os links antigos trazem para cá.
Fontes: bleepingcomputer.com ↗ theregister.com ↗ techcrunch.com ↗ olhardigital.com.br ↗
CISA, the FBI, Health and Human Services (HHS), the USDA and the Department of Transportation issued a joint advisory on Thursday, 5 November 2026, about an ongoing campaign against internet-connected industrial refrigeration and cold-chain monitoring systems (techcrunch.com, theregister.com, bleepingcomputer.com). Since mid-October, attackers have reportedly compromised thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg and Sweden, forcing units to overheat to as high as 50°C (122°F), spoiling food and sparking fires (theregister.com). BleepingComputer estimates 250 to 350 French supermarkets were hit in October, with defrost cycles triggered remotely, and says a second wave in early November hit more than 115 stores across six European countries (bleepingcomputer.com). Olhardigital.com.br reported that on the night of Monday, 2 November, supermarkets in seven European countries were affected and that Delhaize, Belgium's largest retailer, confirmed problems across dozens of stores (olhardigital.com.br). On 3 November the French Blood Establishment (EFS) confirmed that an incident at a refrigeration equipment provider altered temperature and defrost settings at three facilities storing blood products (bleepingcomputer.com). TechCrunch earlier described the attack on a French blood bank as stopped before any losses, and reported US military refrigeration units under Department of Defense investigation (techcrunch.com). Some compromised units were made by Danish vendor Danfoss, which had stopped providing security updates for them (techcrunch.com). The US has not formally attributed the attacks, but researchers and officials reportedly suspect Iran (techcrunch.com); no group has claimed the European attacks (bleepingcomputer.com), and no confirmed attacks on US supermarkets have been documented (theregister.com). CISA's Acting Executive Assistant Director for Cybersecurity, Chris Butera, said every organization relying on refrigeration and monitoring systems should assume it could be a target (bleepingcomputer.com).
Entenda a falha
A vulnerabilidade
No CVE and no single vulnerable product is named. A joint advisory from CISA, the FBI, HHS, USDA and DOT says attackers target unpatched or internet-accessible electronic temperature controllers, commercial refrigeration controllers and cold-chain monitoring systems. The agencies cite authentication bypass flaws, arbitrary code injection flaws and weak configurations. The attacker needs network reach to the exposed device and gets remote control of temperature and defrost settings, with no user interaction mentioned. TechCrunch says some compromised units were Danfoss systems whose vendor had stopped providing security updates. No affected or fixed versions are given.
Como funciona
These controllers are reachable from the internet so operators can monitor temperatures, manage defrost cycles and control cooling equipment remotely. An attacker who reaches the exposed device bypasses authentication, injects code or uses weak or default credentials to gain control. The attacker then changes settings so the unit runs continuous heating and defrost cycles, and can also reduce visibility into real temperatures, delaying detection. Temperatures reportedly reached 50°C, spoiling food and medicines and creating fire hazards. The articles do not describe the internal code path.
Por que é vulnerável
The advisory points to exposure and weak hygiene more than one bug: control devices directly on the public internet, missing or bypassable authentication, default or weak passwords, unpatched firmware and legacy equipment that no longer gets vendor security updates. The articles identify no specific root-cause flaw and describe no fix beyond general mitigations: remove internet exposure, use strong credentials and phishing-resistant MFA, patch where possible, isolate OT networks, enforce safe temperature limits and replace unsupported devices.
Como foi descoberta
The articles do not say how the weaknesses were found. The campaign came to light through reports of attacks on supermarkets in Europe from mid-October; TechCrunch says the hacks were first reported by Signal and Silence. The French Blood Establishment (EFS) said on 3 November that an incident at a refrigeration equipment provider altered settings at three facilities. CISA, the FBI, HHS, USDA and DOT published the joint advisory on 5 November 2026. The US has not formally attributed the attacks: TechCrunch says researchers and officials suspect Iran, while The Register says unknown attackers and BleepingComputer says no group has claimed them.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 00:18.
Detalhes técnicos
- The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers. They remotely alter settings and force units into continuous heating and defrost cycles, causing inventory loss and equipment hazards (theregister.com, techcrunch.com).
- The agencies say attackers are exploiting authentication bypass vulnerabilities, arbitrary code injection flaws or weak configurations. Consequences include inventory losses, reduced equipment lifespan, fire hazards, unsafe storage conditions, and reduced visibility into real-time temperatures, which delays detection of problems (bleepingcomputer.com).
- Reported consequences also include spoiled food and temperature-controlled medications, and harm to consumers of improperly stored products (theregister.com).
- Some systems were shut down entirely in the November wave, with temperatures raised as high as 50°C (bleepingcomputer.com).
- The advisory covers electronic temperature controllers and commercial refrigeration management systems used in healthcare, food production, agriculture, chemical, transportation and medical cold-chain operations, and the warning is worldwide in scope (bleepingcomputer.com, techcrunch.com).
- Neither the advisory nor the articles name a specific CVE or a single vulnerable product. The threat covers internet-exposed electronic temperature and commercial refrigeration controllers broadly (theregister.com, bleepingcomputer.com).
- The EFS incident originated at a refrigeration equipment provider, not directly at the blood facilities (bleepingcomputer.com).
- The US Defense Department's inspector general is investigating freezer and refrigeration malfunctions at several US military commissaries that began in August. It is unclear whether they are connected to the European wave, and prior reporting suggested suspected Iran-linked activity behind those incidents (bleepingcomputer.com).
- Authorities in Europe remain on alert for possible hybrid threats amid tensions with Russia (bleepingcomputer.com).
- The agencies drew a parallel to Iranian hackers who used internet-accessible PLCs, often without passwords, to breach more than 100 US water systems in July (theregister.com).
- Ahold Delhaize (parent of Food Lion, Giant Food and Stop & Shop) proactively took IT systems offline last month after a cyberattack. No link to the refrigeration campaign is established in the sources (theregister.com).
Remediação
- Disconnect industrial control systems and devices, including refrigeration controllers, from the public internet. If remote access is required, place it behind a firewall or edge device kept up to date (theregister.com, techcrunch.com, bleepingcomputer.com).
- Create a dedicated VLAN to isolate OT devices from business networks (theregister.com, bleepingcomputer.com).
- Replace default passwords with strong, unique credentials and enable phishing-resistant multi-factor authentication (theregister.com, techcrunch.com, bleepingcomputer.com).
- Apply patches and security updates promptly and retire legacy equipment that the vendor no longer supports (theregister.com, techcrunch.com, bleepingcomputer.com).
- Enforce safe temperature limits so controllers cannot operate outside acceptable ranges (bleepingcomputer.com).
- Maintain a device/IP allow-list restricting OT access (theregister.com).
- Keep offsite and offline backups (theregister.com).
- Enable logging and review it regularly for unusual activity (theregister.com).
Relatos divergentes
- Attribution: techcrunch.com says researchers and officials reportedly suspect Iran, with no formal US attribution. theregister.com refers to "unknown attackers" and only draws a parallel to earlier Iranian activity against water systems. bleepingcomputer.com, the most recent source, says no group has claimed the European attacks and that no attribution is disclosed in the advisory as reported. Attribution remains unconfirmed.
- Geography: techcrunch.com describes attacks across the United Kingdom and Europe. theregister.com lists France, Belgium, Ireland, Luxembourg and Sweden and does not mention the UK. bleepingcomputer.com says the November wave hit six European countries, while olhardigital.com.br (paywalled, limited detail) says seven. The exact country count is unresolved; the named lists from theregister.com are the most specific.
- Scale: theregister.com reports thousands of systems across hundreds of stores. bleepingcomputer.com gives an estimate of 250 to 350 French supermarkets in October plus more than 115 stores in the November wave. olhardigital.com.br only cites dozens of Delhaize stores in Belgium. These figures are estimates and may not be directly comparable.
- Blood bank: techcrunch.com describes a French blood bank attack stopped before any losses. bleepingcomputer.com, the more recent source, reports that EFS confirmed settings were altered at three facilities storing blood products via a refrigeration equipment provider, and does not state whether any products were lost.
- US military: techcrunch.com says military refrigeration units are under Department of Defense investigation. theregister.com adds that the freezer malfunctions occurred in August and that the Pentagon is reportedly investigating them as a suspected cyberattack. bleepingcomputer.com says the Defense Department's inspector general is investigating, and that it is unclear whether these incidents are connected to the European wave. It is not confirmed that they are part of the same campaign, which began in mid-October.
Linha do tempo
-
FBI, CISA Warn of Attacks on Industrial Refrigeration and Cold-Chain Systems After European Supermarket and Blood Bank Incidents
ler a análise desta fonte ocultar
The FBI and CISA, jointly with the U.S. Departments of Health and Human Services (HHS), Agriculture (USDA), and Transportation (DOT), issued an advisory warning that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, with potential to cause food spoilage, equipment damage, and fire hazards. The warning covers electronic temperature controllers and commercial refrigeration management systems used across healthcare, food production, chemical, and transportation sectors. It follows a wave of attacks in Europe: in October, hackers compromised refrigeration controllers at an estimated 250 to 350 French supermarkets, remotely triggering defrost cycles, and a second wave in November hit more than 115 stores across six European countries, with some systems shut down entirely and temperatures raised as high as 50°C (122°F). On November 3, the French Blood Establishment (EFS) confirmed that a cybersecurity incident at a refrigeration equipment provider altered temperature and defrost settings at three facilities storing blood products. CISA's Acting Executive Assistant Director for Cybersecurity, Chris Butera, said every organization relying on refrigeration and monitoring systems should assume it could be a target.
Technical Details
The agencies state that attackers are exploiting authentication bypass vulnerabilities, arbitrary code injection flaws, or weak configurations in unpatched or internet-accessible controllers to modify temperature settings and force equipment into continuous heating or defrost cycles. This can cause inventory losses, reduced equipment lifespan, fire hazards, unsafe storage conditions, and reduced visibility into real-time temperatures, delaying detection of problems. No specific CVE identifiers, named vulnerable products, or threat actor attribution are disclosed in the advisory as reported; no group has claimed responsibility for the European attacks, and authorities remain on alert for possible hybrid threats amid tensions with Russia (therecord.media). Separately, the U.S. Defense Department's inspector general is investigating freezer and refrigeration malfunctions at several U.S. military commissaries that began in August, though it remains unclear whether these are connected to the European wave (therecord.media); prior reporting had suggested suspected Iran-linked activity behind those military base incidents (nextgov.com).
Remediation
The agencies recommend removing refrigeration controllers from the public internet, securing any necessary remote access, changing default passwords, applying available security updates, isolating operational technology (OT) systems from business networks, and enforcing safe temperature limits to prevent controllers from operating outside acceptable ranges.
-
US agencies warn grocers and cold-chain operators of global refrigeration hacking spree spoiling food, risking fires
ler a análise desta fonte ocultar
The FBI, CISA, Health and Human Services, USDA, and the Department of Transportation issued a joint advisory on Thursday warning operators of industrial refrigeration and cold-chain monitoring systems about an ongoing wave of attacks. Since mid-October, unknown attackers have hacked thousands of remote-controlled refrigeration systems across hundreds of grocery stores in France, Belgium, Ireland, Luxembourg, and Sweden, forcing units to overheat to as high as 50°C (122°F), spoiling food and sparking fires. No confirmed attacks against US supermarkets have been documented, but Ahold Delhaize (parent of Food Lion, Giant Food, and Stop & Shop) proactively took IT systems offline last month after a cyberattack, and the Pentagon is reportedly investigating freezer malfunctions that spoiled food at US military bases in August as a suspected cyberattack.
Technical Details
According to the agencies, the actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards. The article states that attackers gain access by bypassing authentication, injecting arbitrary code, and abusing weak configurations, allowing them to change temperatures to spoil food or temperature-controlled medications, start fires, and potentially harm consumers of improperly stored products. No specific CVE or vulnerable vendor product was named in the advisory or the article; the threat is attributed to internet-exposed electronic temperature and commercial refrigeration controllers broadly, not a single named flaw. Separately, the agencies drew a parallel to Iranian hackers who used internet-accessible programmable logic controllers (PLCs) to breach more than 100 US water systems in July, citing exposed, often password-less devices as an easy entry point for attackers.
Remediation
The agencies urge owners and operators to immediately disconnect industrial control systems and devices from the public internet; if remote access is required, protect it behind a firewall or edge device kept up to date. Additional recommendations include creating a dedicated VLAN to isolate OT devices from business networks, replacing default passwords with strong, unique credentials and enabling phishing-resistant multi-factor authentication, applying patches promptly and retiring unsupported legacy devices, maintaining a device/IP allow-list restricting OT access, keeping offsite and offline backups, and enabling and regularly reviewing logs for unusual activity.
-
CISA, FBI Warn of Ongoing Attacks on Industrial Refrigeration Systems Linked to Suspected Iranian Actors
ler a análise desta fonte ocultar
CISA, the FBI, and the U.S. Departments of Agriculture, Health and Human Services, and Transportation issued a joint advisory warning of an 'ongoing cyber threat' targeting internet-connected industrial refrigeration and cold chain monitoring systems. The warning follows waves of attacks against supermarket freezers across the United Kingdom and Europe, a French blood bank, and U.S. military refrigeration units, in which attackers manipulated temperature settings to spoil food, threaten blood supplies, and risk fire hazards or equipment damage. Some compromised systems were manufactured by Danish company Danfoss, which had stopped providing security updates for the affected units. While the U.S. has not formally attributed the attacks, researchers and officials reportedly suspect Iran is behind the campaign.
Technical Details
Attackers are reportedly gaining remote access to internet-exposed refrigeration control systems and forcing units into continuous heating and defrost cycles, causing inventory loss and equipment hazards. Affected sectors span food, agriculture, transportation, and medical cold-chain operations, including a blood bank in France where an attack on refrigerated blood storage was stopped before causing losses, and U.S. military bases currently under Department of Defense investigation.
Remediation
CISA, the FBI, and partner agencies urge affected organizations to remove remote-control refrigeration systems from direct internet exposure, change and strengthen passwords, apply available patches, and retire equipment no longer supported by vendors.
-
IoT Attack Spikes Supermarket Freezer Temperatures to 50°C Across Seven European Countries
ler a análise desta fonte ocultar
On the night of Monday, November 2, 2026, threat actors remotely tampered with internet-connected refrigeration systems in supermarkets across seven European countries, causing freezer and fridge temperatures to spike to 50°C. Delhaize, Belgium's largest retailer, confirmed problems across dozens of stores. The incident highlights the growing exposure of IoT-connected industrial and retail equipment to cyberattacks, raising concerns about food safety, operational disruption, and the security posture of connected cold-chain infrastructure. The article is behind a paywall and provides limited technical detail on the attack vector or responsible actor.