ENISA warns of attacks on Danfoss freezer controllers in French stores as Pentagon probes freezer failures at US bases
Matéria consolidada. Reúne 6 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 06/11/2026 12:14; os links antigos trazem para cá.
Fontes: securityaffairs.com ×2 ↗ cybersecuritydive.com ↗ olhardigital.com.br ↗
The Pentagon is investigating whether a cyberattack caused freezer failures that spoiled food at commissaries on at least six US military bases in August 2026, according to four officials cited by Reuters (olhardigital.com.br, securityaffairs.com). Affected sites include Fort Irwin, F.E. Warren, Naval Station Newport, Columbus, Travis and Fort Huachuca (securityaffairs.com). In at least one case temperatures were raised overnight. On 26 August, Fort Huachuca (Arizona) reported a freezer entering defrost mode and warming its products, a case first surfaced by the blog Signal and Silence (olhardigital.com.br). A unit of US Cyber Command and the Army Criminal Investigation Division Cyber Field Office are coordinating with interagency, law-enforcement and French authorities over a similar incident that manipulated temperature controls at more than 350 French retail sites. That incident forced frozen goods to be thrown away and in some cases caused units to catch fire, with losses potentially in the tens of millions of euros (securityaffairs.com). On 4 November, ENISA, the European Commission (DG CNECT), Europol EC3, the EU CSIRTs Network and EU-CyCLONe issued a joint warning about attacks on commercial refrigeration systems in several EU Member States. The attacks began in October, with a new wave on 1-2 November (securityaffairs.com). Cybersecurity Dive (cybersecuritydive.com, 3 November) described the attacks as ongoing, with US military investigators working with French agencies. No attribution has been made and the stage of the investigation has not been disclosed.
Entenda a falha
A vulnerabilidade
No CVE or specific bug is named. The weakness is exposure: refrigeration controllers built for on-site maintenance are reachable remotely. In France the target was Danfoss equipment. BFMTV, via securityaffairs, says these were older end-of-support controllers with no security updates, and other systems ran outdated firmware. Researchers had earlier found Danfoss controller flaws, including authentication bypass, but authorities have not confirmed they were exploited. Attackers changed settings remotely at 300+ Intermarché/Netto and under 100 Coopérative U stores, and at commissaries on at least six US bases. The brand at the US bases is unknown. No affected or fixed versions are given.
Como funciona
The articles give no technical steps. As reported, a controller meant for local maintenance is reachable remotely, and someone with access changes its temperature settings. In France the attackers forced freezers into continuous defrost, with some units reportedly reaching 50°C. In the US, temperatures were raised overnight, and Fort Huachuca reported a freezer entering defrost mode on 26 August. The units were heated rather than shut down, which maximizes spoilage, and in France some caught fire. The access method has not been disclosed.
Por que é vulnerável
The causes described are operational: controllers designed for on-site maintenance were exposed to remote access, and end-of-support units and outdated firmware stayed in service. Experts told Reuters the intrusion looked simple. Earlier-found authentication bypass flaws may be relevant, but this is unconfirmed. No code-level defect or fix is described. Mitigations: remove internet exposure, retire unsupported units, update firmware, segment OT from IT, use strong authentication and monitor setpoint changes.
Como foi descoberta
The incidents surfaced through operations and press reporting, not a vulnerability report. Fort Huachuca posted about the defrost case on 26 August, and the blog Signal and Silence reported the failures and possible sabotage on 28 August. Reuters, citing four officials, then said the Pentagon treats them as a suspected hack, with a US Cyber Command unit and Army CID working with French authorities. The French attacks began in October, with a new wave on 1-2 November, and on 4 November ENISA, the European Commission, Europol EC3, the CSIRTs Network and EU-CyCLONe issued a joint warning. Danfoss says similar attacks hit Russia and Israel in 2022. No attribution has been made.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:30.
Detalhes técnicos
- In both the US and France, the pattern was to manipulate refrigeration controllers to raise temperatures rather than shut the units down. This maximizes spoilage and, in France, caused fires (securityaffairs.com).
- In France, attackers remotely changed settings on refrigeration management systems at hundreds of supermarkets and forced freezers into continuous defrost. Some units reportedly reached 50°C, and fresh and frozen stock was destroyed (securityaffairs.com).
- French victims are reportedly about 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets (securityaffairs.com). The Paris prosecutor reportedly said fires also occurred (securityaffairs.com).
- Experts told Reuters the intrusion appeared simple to execute (olhardigital.com.br).
- In the French case the controller manufacturer was Danfoss. BFMTV reported that the targets were Danfoss controllers, older end-of-support units that no longer received security updates, while other systems ran outdated firmware (securityaffairs.com). The brand used at the US bases is unknown, and Reuters could not confirm whether Danfoss or other brands were installed there (olhardigital.com.br, securityaffairs.com).
- A public research report on Danfoss controllers was published before the incidents, but no link to the military bases has been established (securityaffairs.com). Researchers had earlier found Danfoss controller flaws, including authentication bypass, but authorities have not confirmed that these flaws were exploited (securityaffairs.com).
- No CVEs, IOCs or attacker identity have been published (securityaffairs.com, cybersecuritydive.com).
- ICS specialists flag the internet exposure of refrigeration controllers originally designed for on-site maintenance as the core issue (olhardigital.com.br).
- In 2022, attackers hit supermarkets in Russia and Israel using obsolete versions of Danfoss cold-storage controllers (olhardigital.com.br, securityaffairs.com).
- In December 2025, Los Angeles federal prosecutors charged a Ukrainian woman as part of a group that disrupted refrigeration at a meat-processing plant in 2024, destroying over 900 kg of meat (olhardigital.com.br, securityaffairs.com).
Remediação
- Inventory internet-exposed refrigeration/HVAC and other OT/ICS building controllers, and remove that exposure. ENISA urges immediate action to reduce the exposure of the affected systems and has published a collection of national CSIRT technical advisories (securityaffairs.com).
- Retire obsolete and end-of-support units and update outdated firmware.
- Segment the controllers from general IT networks, restrict remote access, enforce strong authentication, and monitor for unauthorized setpoint or configuration changes (securityaffairs.com).
- Share information rapidly, as ENISA stresses (securityaffairs.com).
- Align food-safety and IT/OT security teams, as the Global Food Safety Initiative recommended in early 2026 (olhardigital.com.br, securityaffairs.com).
- Regulatory background: under the Cyber Resilience Act, manufacturers have had to report severe incidents and actively exploited vulnerabilities since 11 September 2026, and the main CRA requirements apply from 11 December 2027. NIS2 entities must manage cyber risk and report significant incidents (securityaffairs.com).
Relatos divergentes
- Scope (US): Both earlier sources say at least six commissaries were affected. securityaffairs.com adds that some reports count up to 14 sites across 11 states; this is not confirmed by the officials cited.
- Scope (France): The record cited more than 350 French retail sites. The ENISA-based report from securityaffairs.com, the most recent, gives about 300 Intermarché and Netto stores plus fewer than 100 Coopérative U outlets, which are approximate and reportedly figures, not a confirmed count.
- Timing: The US freezer failures were reported in August 2026 (olhardigital.com.br), while the EU statement relayed by securityaffairs.com says the attacks on refrigeration systems began in October. The link between the two sets of incidents is under investigation and not confirmed.
- Danfoss position: olhardigital.com.br says Danfoss stated that several controllers in the affected French equipment were obsolete or running outdated firmware. securityaffairs.com, published later, says Danfoss did not reply to press inquiries. The Danfoss statement is therefore not corroborated by that source. The latest securityaffairs.com report attributes the end-of-support finding to BFMTV rather than to Danfoss.
Linha do tempo
-
ENISA and EU bodies warn of attacks on Danfoss refrigeration controllers hitting French supermarkets
The joint ENISA, European Commission, Europol EC3, EU CSIRTs Network and EU-CyCLONe statement of 4 November reports attacks on commercial refrigeration systems in several Member States. The attacks began in October, with a new wave on 1-2 November. French victims are reportedly about 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets. BFMTV reported that the French incidents involved end-of-support or outdated Danfoss controllers. No attribution has been given.
ler a análise desta fonte ocultar
The joint ENISA, European Commission, Europol EC3, EU CSIRTs Network and EU-CyCLONe statement of 4 November reports attacks on commercial refrigeration systems in several Member States. The attacks began in October, with a new wave on 1-2 November. French victims are reportedly about 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets. BFMTV reported that the French incidents involved end-of-support or outdated Danfoss controllers. No attribution has been given.
ENISA, the European Commission (DG CNECT), Europol EC3, the EU CSIRTs Network and EU-CyCLONe issued a joint warning on 4 November. It follows attacks on commercial refrigeration systems in several EU Member States. The attacks began in October, and a new wave hit on 1-2 November. In France, attackers remotely changed settings on refrigeration management systems at hundreds of supermarkets and forced freezers into continuous defrost. Some units reportedly reached 50°C, and fresh and frozen stock was destroyed. About 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets were reportedly affected. Authorities have not attributed the campaign.
Technical Details
- BFMTV reported that the targets were Danfoss refrigeration controllers used in French stores (securityaffairs.com).
- The devices were older controllers that were end-of-support and no longer received security updates. Other systems ran outdated firmware (securityaffairs.com).
- Researchers had earlier found Danfoss controller flaws, including authentication bypass. Authorities have not confirmed that these flaws were exploited (securityaffairs.com).
- The Paris prosecutor reportedly said fires also occurred (securityaffairs.com).
- The article gives no CVEs, IOCs or attacker identity.
Remediation
- ENISA urges immediate action to reduce exposure of the affected systems. It has published a collection of national CSIRT technical advisories (securityaffairs.com).
- ENISA also stresses rapid information-sharing.
- The article recalls the regulatory background. Under the Cyber Resilience Act, manufacturers have had to report severe incidents and actively exploited vulnerabilities since 11 September 2026. The main CRA requirements apply from 11 December 2027. NIS2 entities must manage cyber risk and report significant incidents.
-
European and US authorities investigate ongoing attacks on grocery refrigerators and hacks at US military bases
ler a análise desta fonte ocultar
European authorities are investigating ongoing attacks targeting grocery refrigerators, according to Cybersecurity Dive. US military investigators are working with French agencies after hacks hit domestic bases. The source provides only a headline and subhead. It gives no details on the attack method, vulnerabilities, affected products, victims, attribution or impact. Treat the story as an open investigation with unconfirmed scope.
Technical Details
The source states no technical details, CVEs, indicators or attacker identity.
Remediation
The source gives no remediation guidance. Generic advice for operators of building and refrigeration control systems is to avoid exposing them directly to the internet, restrict remote access, and watch for unexpected configuration changes.
-
Pentagon probes August freezer failures at US military commissaries as suspected cyberattack, links to French supermarket hack
ler a análise desta fonte ocultar
The Pentagon is treating a series of freezer malfunctions that spoiled food at US military base commissaries in August as a suspected cyberattack, according to four officials cited by Reuters. At least six commissaries were affected in late August — Fort Irwin, F.E. Warren, Naval Station Newport, Columbus, Travis and Fort Huachuca among them — with some reports counting up to 14 sites across 11 states. In at least one case the freezers were not simply shut down: temperatures were raised overnight, and Fort Huachuca reported its freezer entered defrost mode and heated the stored food. US investigators, including a unit of US Cyber Command and the Army Criminal Investigation Division Cyber Field Office, are coordinating with French law enforcement over a similar attack that raised cooling temperatures in more than 350 French supermarkets, emptying frozen aisles and in some cases causing units to catch fire, with losses potentially in the tens of millions of euros. Attribution remains unknown and the investigation's progress is undisclosed.
Technical Details
The attack pattern in both the US and France involved manipulating refrigeration controllers to increase temperatures rather than disabling the units, maximizing spoilage and in France causing fires. In the French case the targeted controller manufacturer was Danfoss, which did not reply to press inquiries; the brand used at US bases is unknown. A public research report on Danfoss controllers was published before the incidents, but no link to the military bases has been established. Danfoss has previously reported that attackers hit supermarkets in Russia and Israel in 2022 by exploiting outdated cooling controllers, and in December 2025 US prosecutors accused a Ukrainian woman of belonging to a group that disrupted refrigeration at a meat plant in 2024.
Remediation
Operators of commercial refrigeration and other OT/ICS building systems should inventory internet-exposed cooling controllers, update outdated firmware, segment them from general IT networks, enforce strong authentication and monitor for unauthorized setpoint changes. The Global Food Safety Initiative has urged food safety and IT leaders to jointly protect refrigeration systems.
-
Pentagon probes suspected cyberattack on military base commissary freezers; linked to French supermarket refrigeration hacks
ler a análise desta fonte ocultar
The Pentagon is investigating whether a cyberattack caused refrigeration failures at commissaries on at least six US military bases in August 2026, spoiling food, according to four officials cited by Reuters. In one case the freezer temperature was raised overnight; on 26 August, Fort Huachuca (Arizona) reported a freezer entering defrost mode and warming products, a case first surfaced by the blog Signal and Silence. A unit of US Cyber Command and the Army Criminal Investigation Division Cyber Field Office are coordinating with interagency, law-enforcement and French authorities over a similar incident in which temperature controls were manipulated at more than 350 French retail sites, forcing disposal of frozen goods and in some cases causing units to catch fire. No attribution or investigation stage has been disclosed.
Technical Details
Experts told Reuters the intrusion appeared simple to execute. Danfoss stated that several controllers in the affected French equipment were obsolete or running outdated firmware, which could have eased unauthorized access; Reuters could not confirm whether Danfoss or other brands were installed at the US bases. The core issue flagged by ICS specialists is the internet exposure of refrigeration controllers originally designed for on-site maintenance. Danfoss also noted that in 2022 attackers hit supermarkets in Russia and Israel using obsolete versions of its cold-storage controllers. In December 2025, Los Angeles federal prosecutors charged a Ukrainian woman as part of a group that disrupted refrigeration at a meat-processing plant in 2024, destroying over 900 kg of meat.
Remediation
Inventory and remove internet exposure of refrigeration/HVAC controllers, retire obsolete units and update firmware, and align food-safety and IT/OT security teams as recommended in early 2026 by the Global Food Safety Initiative.