EN PT-BR
← Voltar ao feed
critical healthcare food_and_agriculture chemicals transportation

Attacks on refrigeration and cold-chain controllers in France prompt joint US warning to critical infrastructure

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 19:00 · coletado há 1 hora

CISA, the FBI, HHS, USDA and the Department of Transportation published a joint fact sheet warning that attackers are remotely targeting electronic-temperature and commercial-refrigeration controllers used in grocery stores and cold storage. The warning follows attacks on French blood banks and European supermarkets, where hundreds of grocery stores in France had food spoiled and fires triggered. The National Cybersecurity Agency of France (ANSSI) has investigated since mid-October and reports compromises involving Danfoss AK-SM and AK-SC series controllers, Copeland controllers and Dixell XWEB controllers. Intruders take advantage of unpatched flaws, misconfigurations and weak or hard-coded passwords, and once inside they can alter temperature controls, with fire risk as a consequence. Urgency is rated critical because the activity is ongoing, has reached multiple sectors and affects physical processes, although the access path relies on default or weak credentials and internet exposure rather than a single unauthenticated flaw. The vendor advisories from Danfoss and Copeland were not retrieved during this research, so no CVE or fixed firmware version is confirmed here.

Detalhes técnicos

  • Targets are electronic-temperature and commercial-refrigeration controllers in grocery stores and cold storage facilities, reached remotely.
  • Entry points named by the agencies are unpatched vulnerabilities, misconfigurations, and weak or hard-coded passwords.
  • Once remote access is obtained, attackers manipulate temperature controls to spoil refrigerated products such as blood and food; the agencies note that temperature changes could also trigger fires.
  • Controller families named by ANSSI in the affected French incidents: Danfoss AK-SM and AK-SC series, Copeland controllers, and Dixell XWEB controllers.
  • No malware family, IOC or threat actor is named in the article or the pages consulted.

Remediação

The joint fact sheet recommends organizations immediately:

  • Use strong authentication mechanisms and change default passwords.
  • Keep systems updated and promptly patch critical vulnerabilities.
  • Replace legacy devices that have reached end-of-life status.
  • Identify systems accessible from the internet.
  • Isolate operational technology (OT) systems from business networks.
  • Remove unnecessary remote access and secure the remote access that remains necessary.
  • Maintain offsite backups.

Linha do tempo

  1. tenable.com ↗ · pub. 09/11/2026 19:00 · coletado 09/11 19:00 primeiro registro

    Attacks on refrigeration and cold-chain controllers in France prompt joint US warning to critical infrastructure

    ler a análise desta fonte

    CISA, the FBI, HHS, USDA and the Department of Transportation published a joint fact sheet warning that attackers are remotely targeting electronic-temperature and commercial-refrigeration controllers used in grocery stores and cold storage. The warning follows attacks on French blood banks and European supermarkets, where hundreds of grocery stores in France had food spoiled and fires triggered. The National Cybersecurity Agency of France (ANSSI) has investigated since mid-October and reports compromises involving Danfoss AK-SM and AK-SC series controllers, Copeland controllers and Dixell XWEB controllers. Intruders take advantage of unpatched flaws, misconfigurations and weak or hard-coded passwords, and once inside they can alter temperature controls, with fire risk as a consequence. Urgency is rated critical because the activity is ongoing, has reached multiple sectors and affects physical processes, although the access path relies on default or weak credentials and internet exposure rather than a single unauthenticated flaw. The vendor advisories from Danfoss and Copeland were not retrieved during this research, so no CVE or fixed firmware version is confirmed here.

    Technical Details

    • Targets are electronic-temperature and commercial-refrigeration controllers in grocery stores and cold storage facilities, reached remotely.
    • Entry points named by the agencies are unpatched vulnerabilities, misconfigurations, and weak or hard-coded passwords.
    • Once remote access is obtained, attackers manipulate temperature controls to spoil refrigerated products such as blood and food; the agencies note that temperature changes could also trigger fires.
    • Controller families named by ANSSI in the affected French incidents: Danfoss AK-SM and AK-SC series, Copeland controllers, and Dixell XWEB controllers.
    • No malware family, IOC or threat actor is named in the article or the pages consulted.

    Remediation

    The joint fact sheet recommends organizations immediately:

    • Use strong authentication mechanisms and change default passwords.
    • Keep systems updated and promptly patch critical vulnerabilities.
    • Replace legacy devices that have reached end-of-life status.
    • Identify systems accessible from the internet.
    • Isolate operational technology (OT) systems from business networks.
    • Remove unnecessary remote access and secure the remote access that remains necessary.
    • Maintain offsite backups.