CISA, FBI and partners warn of global attacks on industrial refrigeration and cold-chain controllers after European supermarket spree
A joint U.S. federal advisory from CISA, the FBI, HHS, the USDA and the DOT warns that threat actors are actively targeting internet-exposed industrial refrigeration and cold-chain monitoring controllers worldwide, with effects ranging from spoiled inventory to fire hazards. The agencies state the actors exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles. The warning follows a wave of attacks on hundreds of supermarkets, small grocers and butchers across twelve European countries, where temperatures were pushed as high as 50 °C or units forced into defrost. Among the victims was the French Blood Establishment, which confirmed an incident at a refrigeration equipment provider raised temperature and defrost settings to extremely high levels at three blood plasma storage facilities. No attribution has been established, and the advisory names no CVE. The fact sheet is dated 5 November 2026 and also covers healthcare, chemicals, food production, agriculture and transport, including refrigerated delivery services (cybersecuritynews.com).
Detalhes técnicos
The agencies assess that actors are likely to abuse authentication bypasses, arbitrary code injection and weak configurations — including default credentials and legacy devices — to reach the controllers. Observed and anticipated effects are temperature manipulation that shortens equipment service life, creates a fire hazard, destroys inventory or endangers consumers of improperly stored products, and loss of visibility into temperatures through denial-of-service. Exposure data from Censys shows Danfoss StoreView internet-exposed instances falling from 3,004 to 708 between 9 October and 5 November 2026, most of them in France, while Copeland/Dixell XWEB exposure fell from 3,708 to 2,420. Censys also reports North America accounts for roughly 38% of global ICS exposure, Asia's share rising from 22% in 2024 to 25% in 2026 and Europe's falling from 36.5% to 32%.
Remediação
Owners and operators are urged to enforce strong authentication, change default passwords, keep controllers patched, inventory and remove internet-accessible systems, isolate OT devices from IT networks, retire and replace legacy equipment, and remove unnecessary remote access while hardening the remote access that remains.
Linha do tempo
-
CISA, FBI and partners warn of global attacks on industrial refrigeration and cold-chain controllers after European supermarket spree
ler a análise desta fonte ocultar
A joint U.S. federal advisory from CISA, the FBI, HHS, the USDA and the DOT warns that threat actors are actively targeting internet-exposed industrial refrigeration and cold-chain monitoring controllers worldwide, with effects ranging from spoiled inventory to fire hazards. The agencies state the actors exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles. The warning follows a wave of attacks on hundreds of supermarkets, small grocers and butchers across twelve European countries, where temperatures were pushed as high as 50 °C or units forced into defrost. Among the victims was the French Blood Establishment, which confirmed an incident at a refrigeration equipment provider raised temperature and defrost settings to extremely high levels at three blood plasma storage facilities. No attribution has been established, and the advisory names no CVE. The fact sheet is dated 5 November 2026 and also covers healthcare, chemicals, food production, agriculture and transport, including refrigerated delivery services (cybersecuritynews.com).
Technical Details
The agencies assess that actors are likely to abuse authentication bypasses, arbitrary code injection and weak configurations — including default credentials and legacy devices — to reach the controllers. Observed and anticipated effects are temperature manipulation that shortens equipment service life, creates a fire hazard, destroys inventory or endangers consumers of improperly stored products, and loss of visibility into temperatures through denial-of-service. Exposure data from Censys shows Danfoss StoreView internet-exposed instances falling from 3,004 to 708 between 9 October and 5 November 2026, most of them in France, while Copeland/Dixell XWEB exposure fell from 3,708 to 2,420. Censys also reports North America accounts for roughly 38% of global ICS exposure, Asia's share rising from 22% in 2024 to 25% in 2026 and Europe's falling from 36.5% to 32%.
Remediation
Owners and operators are urged to enforce strong authentication, change default passwords, keep controllers patched, inventory and remove internet-accessible systems, isolate OT devices from IT networks, retire and replace legacy equipment, and remove unnecessary remote access while hardening the remote access that remains.