US agencies warn of attacks on internet-exposed refrigeration controllers after European supermarket and blood bank incidents
CISA, the FBI, HHS, USDA and DoT issued a joint advisory urging healthcare, chemical, food and transportation organizations to harden commercial refrigeration and cold chain controllers. Attackers have been tampering with monitoring systems in European supermarkets and blood banks. On October 11 they set fridges to 50°C and freezers to defrost at hundreds of supermarkets, spoiling food and in some cases causing fires. A second wave this week hit more than 100 supermarkets and a blood bank. Only the supermarkets suffered losses. Separately, the French Blood Establishment (EFS) said quick action by its staff prevented the compromise of blood products and samples. Attribution is unconfirmed. Russian hacktivist groups Noname057(16) and Z-Pentest Alliance reportedly claimed to have hacked Danfoss, but Iranian hacktivists or state-sponsored actors may also be responsible (BBC, as cited by the article). The campaign is rated critical because the attacks are ongoing, have caused mass physical and financial damage, and target exposed controllers.
Entenda a falha
A vulnerabilidade
No CVE is assigned. A joint advisory from CISA, the FBI, HHS, USDA and DoT warns that attackers target electronic temperature and commercial refrigeration controllers, including Copeland/Dixell XWEB and Danfoss StoreView, in retail grocery and cold storage sites. The agencies say actors may exploit authentication bypasses, code injection, weak configurations and unpatched or internet-accessible controllers. Reaching the exposed management interface lets them change settings remotely, force continuous heating and defrost cycles, or cause denial-of-view. The articles name no affected or fixed versions.
Como funciona
The controllers are monitoring and management systems for fridges and freezers, reachable through a web interface. When that interface is exposed to the internet, an attacker can reach it and, using an authentication bypass, code injection or weak credentials and settings, gain access to the management functions. The system then accepts the attacker's changes as legitimate commands, such as setting fridges to 50°C or putting freezers into defrost. The articles do not detail which step fails in each product.
Por que é vulnerável
According to the advisory, the weaknesses are a mix of authentication bypasses, code injection, weak configurations and unpatched systems, made far more dangerous by exposing OT controllers directly to the internet. The articles do not give a specific root cause per product or say what a fix changes. The recommended mitigation is to remove internet exposure or put the controllers behind a firewall or edge device.
Como foi descoberta
The issue came to light through exploitation in the wild: on October 11 attackers hit hundreds of European supermarkets, and a second wave this week hit more than 100 supermarkets and a blood bank. The US agencies then issued their joint advisory. Attribution is unconfirmed: Noname057(16) and Z-Pentest Alliance reportedly claimed to have hacked Danfoss, but the BBC notes Iranian hacktivists or state-sponsored hackers may also be responsible. Censys counted 6,695 exposed controllers on October 9 and 3,124 (47%) on November 5.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:18.
Detalhes técnicos
The agencies say the actors may exploit authentication bypasses, code injection, weak configurations, and unpatched or internet-accessible controllers. They use these to change settings remotely, force continuous heating and defrost cycles, or cause denial-of-view conditions. The article names no CVEs. Censys counted 6,695 internet-exposed controllers on October 9. On November 5, 3,124 (47%) were still reachable. Copeland/Dixell XWEB exposure fell 35% (3,708 to 2,420). Danfoss StoreView exposure fell 76% (3,004 to 708).
Remediação
- Take the control systems off the internet. If web access is needed, put them behind a firewall or edge device.
- Isolate OT devices and restrict access to trusted identities.
- Enforce strong passwords and phishing-resistant MFA.
- Keep systems updated and maintain offsite backups.
- Enable logging and monitoring.
Linha do tempo
-
US agencies warn of attacks on internet-exposed refrigeration controllers after European supermarket and blood bank incidents
ler a análise desta fonte ocultar
CISA, the FBI, HHS, USDA and DoT issued a joint advisory urging healthcare, chemical, food and transportation organizations to harden commercial refrigeration and cold chain controllers. Attackers have been tampering with monitoring systems in European supermarkets and blood banks. On October 11 they set fridges to 50°C and freezers to defrost at hundreds of supermarkets, spoiling food and in some cases causing fires. A second wave this week hit more than 100 supermarkets and a blood bank. Only the supermarkets suffered losses. Separately, the French Blood Establishment (EFS) said quick action by its staff prevented the compromise of blood products and samples. Attribution is unconfirmed. Russian hacktivist groups Noname057(16) and Z-Pentest Alliance reportedly claimed to have hacked Danfoss, but Iranian hacktivists or state-sponsored actors may also be responsible (BBC, as cited by the article). The campaign is rated critical because the attacks are ongoing, have caused mass physical and financial damage, and target exposed controllers.
Technical Details
The agencies say the actors may exploit authentication bypasses, code injection, weak configurations, and unpatched or internet-accessible controllers. They use these to change settings remotely, force continuous heating and defrost cycles, or cause denial-of-view conditions. The article names no CVEs. Censys counted 6,695 internet-exposed controllers on October 9. On November 5, 3,124 (47%) were still reachable. Copeland/Dixell XWEB exposure fell 35% (3,708 to 2,420). Danfoss StoreView exposure fell 76% (3,004 to 708).
Remediation
- Take the control systems off the internet. If web access is needed, put them behind a firewall or edge device.
- Isolate OT devices and restrict access to trusted identities.
- Enforce strong passwords and phishing-resistant MFA.
- Keep systems updated and maintain offsite backups.
- Enable logging and monitoring.