FBI, CISA, HHS Warn of Attacks on Refrigeration and Cold Chain Controllers After European Supermarket and Blood Bank Incidents
A joint fact sheet from the FBI, CISA, HHS, USDA and DOT warns that malicious actors are targeting unpatched or internet-exposed temperature controllers and commercial refrigeration controllers. The warning followed attacks that began in mid-October 2026 in Europe. Attackers remotely raised temperatures and triggered defrost cycles. Hundreds of French supermarkets discarded produce, and the French blood bank EFS nearly lost blood products. In one case, parameters were set that would have pushed temperatures to 150°C. Attribution is unconfirmed. The bulletproof hosting used has previously been linked to Russia-linked operations, but that alone does not prove state sponsorship. Many intrusions used the manufacturer's default credentials.
Entenda a falha
A vulnerabilidade
No CVE is assigned and no specific product or vendor is named. The weakness is in internet-exposed industrial and commercial refrigeration controllers, temperature controllers and cold chain monitoring systems that are unpatched, still use the manufacturer's default credentials, or are poorly configured. An attacker only needs network reach to the exposed controller and, in many cases, the default login. They can then change temperature and defrost thresholds, causing food spoilage, fire hazards and hardware damage. The fact sheet also cites authentication bypass and arbitrary code injection as possible paths, without naming affected or fixed versions.
Como funciona
The controller exposes its management interface to the internet. An attacker connects remotely and logs in, often with the manufacturer's default credentials. Once authenticated, the controller accepts the attacker's commands as legitimate operator changes. It then applies the new temperature and defrost parameters to the refrigeration hardware. In the European incidents this raised temperatures, triggered defrost cycles, and in one case set parameters that would have reached 150°C.
Por que é vulnerável
The main cause is poor exposure and credential hygiene: devices reachable directly from the internet and left with default passwords, so the only barrier is a well-known login. Unpatched firmware and end-of-support devices add to the risk, and the fact sheet mentions authentication bypass, code injection and weak configurations as further causes. The articles do not describe a specific code-level root cause or a vendor fix. The recommended remediation is to remove direct internet exposure, change default and weak passwords, apply patches and firmware updates, and replace unsupported devices.
Como foi descoberta
The issue came to light through exploitation in the wild: attacks began in mid-October 2026 in Europe, hitting hundreds of French supermarkets and the French blood bank EFS, which caught the temperature rise in time. Stores in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden also reported refrigeration problems. The FBI, CISA, HHS, USDA and DOT then published a joint fact sheet in early November 2026. Attribution is unconfirmed: the bulletproof hosting used was previously linked to Russia-linked operations, but that alone does not prove state sponsorship.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:20.
Detalhes técnicos
- Attackers gained remote access to internet-exposed controllers, often with default credentials, and altered temperature and defrost thresholds.
- The fact sheet also cites authentication bypass, arbitrary code injection and weak configurations as possible attack paths (cisa.gov).
- Reported impacts: food spoilage, inventory loss, fire hazards and hardware damage.
- Sectors named: healthcare and public health, food and agriculture, chemical, and transportation (cisa.gov).
- Stores in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported refrigeration problems (cisa.gov).
- The article and the CISA release name no CVEs, malware or IOCs.
Remediação
- Remove control systems from direct internet exposure.
- Change default passwords and use strong passwords.
- Apply patches and firmware updates promptly.
- Retire and replace end-of-support devices.
- Monitor for unexpected activity.
- Report suspicious activity to the FBI, CISA or, for healthcare entities, HHS (cisa.gov).
Linha do tempo
-
FBI, CISA, HHS Warn of Attacks on Refrigeration and Cold Chain Controllers After European Supermarket and Blood Bank Incidents
ler a análise desta fonte ocultar
A joint fact sheet from the FBI, CISA, HHS, USDA and DOT warns that malicious actors are targeting unpatched or internet-exposed temperature controllers and commercial refrigeration controllers. The warning followed attacks that began in mid-October 2026 in Europe. Attackers remotely raised temperatures and triggered defrost cycles. Hundreds of French supermarkets discarded produce, and the French blood bank EFS nearly lost blood products. In one case, parameters were set that would have pushed temperatures to 150°C. Attribution is unconfirmed. The bulletproof hosting used has previously been linked to Russia-linked operations, but that alone does not prove state sponsorship. Many intrusions used the manufacturer's default credentials.
Technical Details
- Attackers gained remote access to internet-exposed controllers, often with default credentials, and altered temperature and defrost thresholds.
- The fact sheet also cites authentication bypass, arbitrary code injection and weak configurations as possible attack paths (cisa.gov).
- Reported impacts: food spoilage, inventory loss, fire hazards and hardware damage.
- Sectors named: healthcare and public health, food and agriculture, chemical, and transportation (cisa.gov).
- Stores in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported refrigeration problems (cisa.gov).
- The article and the CISA release name no CVEs, malware or IOCs.
Remediation
- Remove control systems from direct internet exposure.
- Change default passwords and use strong passwords.
- Apply patches and firmware updates promptly.
- Retire and replace end-of-support devices.
- Monitor for unexpected activity.
- Report suspicious activity to the FBI, CISA or, for healthcare entities, HHS (cisa.gov).