CISA, FBI and partners warn of attacks on refrigeration controllers after supermarket and blood bank cooling disruptions across Europe
CISA, the FBI, HHS, USDA and DOT issued a joint advisory/fact sheet on Thursday (5 November 2026) warning of malicious activity against industrial refrigeration and cold-chain monitoring systems worldwide. Targets are electronic temperature controllers and commercial refrigeration controllers in retail grocery stores and cold storage. Affected sectors are healthcare and public health, chemical, food and agriculture, and transportation. The warning follows two waves of attacks on European supermarkets: Oct. 11-12 in France, and Nov. 2 across at least seven EU countries, where more than 100 stores and businesses reported problems. Help Net Security reports the second wave hit Belgium, Luxembourg and Sweden, with later reports adding Finland, Ireland, Estonia and the Netherlands (helpnetsecurity.com). The French Blood Establishment (EFS) confirmed that three of its blood banks detected a temperature spike in their cold rooms after one of its refrigeration equipment providers was hit (helpnetsecurity.com). No group has claimed responsibility, and authorities have not established whether one perpetrator is behind both waves. Help Net Security notes the synchronized timing across countries suggests a possible nation-state actor, but this is speculation (helpnetsecurity.com).
Entenda a falha
A vulnerabilidade
No CVE is assigned. The joint CISA, FBI, HHS, USDA and DOT fact sheet says attackers may exploit unpatched or internet-accessible electronic temperature and commercial refrigeration controllers through authentication bypass, arbitrary code injection and weak configurations. Danfoss said some targeted systems in the Netherlands were on unsecured networks and still used default passwords. A Cato Networks commentator pointed to published research on flaws in Danfoss AK-SM 800A and Copeland XWEB Pro, but their use in these attacks is not confirmed. The articles give no affected or fixed versions. A successful attacker can change setpoints remotely, force heating and defrost cycles and hide current temperatures.
Como funciona
The controllers monitor and log temperatures, manage defrost cycles and keep energy use in check. When a controller panel is reachable from the internet, for example directly or through a maintenance provider's cellular link, an attacker can reach its management interface. If they get past authentication, whether by a bypass, injected code or a default password, they can change its settings. The controller then follows the altered settings: Sabcobel said evaporators were switched into defrost mode, and temperatures rose. The articles do not describe the technical steps of the bypass or injection.
Por que é vulnerável
According to the agencies, the exposure comes from internet-reachable controllers, unpatched firmware, weak configurations and default or shared passwords. Danfoss confirmed default passwords and unsecured networks in the Netherlands cases. The articles do not give a root cause for the authentication bypass or code injection, and they do not say what a fix changes. The advice is to keep firmware current, retire end-of-life equipment and remove public exposure.
Como foi descoberta
The activity came to light through two waves of attacks on European supermarkets, on Oct. 11-12 in France and on Nov. 2 across at least seven EU countries, where more than 100 stores and businesses reported problems. Three French Blood Establishment (EFS) blood banks detected temperature spikes after a refrigeration equipment provider was hit. CISA, the FBI, HHS, USDA and DOT published a joint fact sheet on Thursday, Nov. 5, 2026. No group has claimed responsibility, and authorities have not established whether one actor is behind both waves. Help Net Security says the synchronized timing suggests a possible nation-state actor, which is speculation.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 09:52.
Detalhes técnicos
- The agencies say attackers may exploit unpatched or internet-accessible devices through authentication bypass, arbitrary code injection and weak configurations (industrialcyber.co, helpnetsecurity.com).
- Attackers can change temperature settings remotely, trigger continuous heating and defrost cycles, and disrupt temperature visibility ("denial-of-view condition"). The results are inventory losses and equipment and fire hazards. Food or medicine kept in unsafe conditions could indirectly harm consumers (helpnetsecurity.com).
- In France, freezers and fridges reportedly reached up to 50 °C and some stores had fires.
- On Nov. 2, Sabcobel said attackers accessed cooling systems and switched evaporators into defrost mode.
- Danfoss said some targeted systems in the Netherlands were on unsecured networks and still used default passwords.
- A Cato Networks commentator noted published research on vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB Pro controllers. Their exploitation in these attacks is not confirmed.
- A Pentagon investigation into suspected attacks on refrigeration at military commissaries was reported by Xage Security. The article does not confirm it.
Remediação
- Remove direct public internet exposure, including maintenance providers' cellular connections.
- Isolate OT from business networks (dedicated VLAN).
- Change passwords and use phishing-resistant MFA (the agencies' guidance). Danfoss and Cato Networks commentary adds replacing default and shared passwords.
- Keep firmware current and retire end-of-life equipment.
- Allowlist authorized devices and IP addresses.
- Keep tested offsite and offline backups.
- Enable logging, and collect network traffic where OT assets lack logs.
- Set safe temperature limits downstream of controllers, with deviation alerts, and use independent temperature monitoring.
- Secure necessary remote access through firewalls or edge devices kept up to date.
- Report suspicious activity to the FBI (helpnetsecurity.com).
Linha do tempo
-
CISA, FBI, HHS, USDA and DOT warn of attacks on refrigeration controllers after European supermarket and blood bank disruptions
The article adds that the French Blood Establishment (EFS) confirmed temperature spikes in three blood banks after a refrigeration equipment provider was hit. It also names more affected countries (Sweden, Luxembourg, Finland, Ireland, Estonia) and quotes CISA and FBI officials. Help Net Security says the synchronized timing suggests a possible nation-state actor, though the attackers remain unidentified.
ler a análise desta fonte ocultar
The article adds that the French Blood Establishment (EFS) confirmed temperature spikes in three blood banks after a refrigeration equipment provider was hit. It also names more affected countries (Sweden, Luxembourg, Finland, Ireland, Estonia) and quotes CISA and FBI officials. Help Net Security says the synchronized timing suggests a possible nation-state actor, though the attackers remain unidentified.
Five US agencies (CISA, FBI, HHS, USDA and DOT) published a joint advisory on 5 November 2026. It warns of ongoing malicious activity against industrial refrigeration and cold-chain monitoring systems worldwide. Attackers are going after electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage. They can push units into continuous heating and defrost cycles, which causes inventory loss, equipment damage and fire hazards. Affected sectors are healthcare and public health, chemical, food and agriculture, and transportation. The advisory follows attacks on supermarkets in France and other European countries. The attackers remain unidentified, and the synchronized timing suggests a possible nation-state actor (helpnetsecurity.com).
Technical Details
- The agencies say attackers may exploit controllers that are unpatched or reachable from the internet. The routes named are authentication bypass, arbitrary code injection and weak configurations.
- Once inside, attackers can change temperature settings remotely and force units into heating.
- Operators may also lose sight of current temperatures, which the agencies call a "denial-of-view condition".
- Unsafe storage could indirectly harm consumers if food or medicine is consumed afterwards.
- Help Net Security reports that hundreds of French supermarkets were hit overnight. A second wave three weeks later hit Belgium, Luxembourg and Sweden. Later reports added Finland, Ireland, Estonia and the Netherlands.
- The French Blood Establishment (EFS) confirmed that three blood banks detected a temperature spike in their cold rooms after one of its refrigeration equipment providers was hit.
- The article names no CVEs, IOCs or specific vendor products.
Remediation
- Stop exposing controller panels and other control system devices to the internet. Where remote access is unavoidable, route it through a firewall or edge device kept at its latest version.
- Put OT devices on a dedicated VLAN separate from business networks.
- Change default passwords and enable phishing-resistant MFA where feasible.
- Keep firmware up to date, and retire and replace devices the vendor no longer supports.
- Limit changes with device and IP address allowlisting.
- Keep tested offline backups and enable logging.
- Define reasonable setpoint limits for devices downstream of controllers, and alert on any deviation.
- Report suspicious activity to the FBI.
-
CISA, FBI and partners warn of attacks on exposed refrigeration controllers after supermarket cooling disruptions across Europe
ler a análise desta fonte ocultar
CISA, the FBI, HHS, USDA and DOT issued a joint fact sheet on Thursday warning of malicious activity against industrial refrigeration and cold-chain monitoring systems worldwide. Targets are electronic temperature controllers and commercial refrigeration controllers in retail grocery stores and cold storage. Affected sectors are healthcare and public health, chemical, food and agriculture, and transportation. The warning follows two waves of attacks on European supermarkets: Oct. 11-12 in France, and Nov. 2 across at least seven EU countries, where more than 100 stores and businesses reported problems. No group has claimed responsibility, and authorities have not established whether one perpetrator is behind both waves.
Technical Details
- The agencies say attackers may exploit unpatched or internet-accessible devices through authentication bypass, arbitrary code injection and weak configurations (industrialcyber.co, reporting the fact sheet).
- Attackers can change temperature settings remotely, trigger continuous heating and defrost cycles, and disrupt temperature visibility. The results are inventory losses and equipment and fire hazards.
- In France, freezers and fridges reportedly reached up to 50 °C and some stores had fires.
- On Nov. 2, Sabcobel said attackers accessed cooling systems and switched evaporators into defrost mode.
- Danfoss said some targeted systems in the Netherlands were on unsecured networks and still used default passwords.
- A Cato Networks commentator noted published research on vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB Pro controllers. Their exploitation in these attacks is not confirmed.
- A Pentagon investigation into suspected attacks on refrigeration at military commissaries was reported by Xage Security. The article does not confirm it.
Remediation
- Remove direct public internet exposure, including maintenance providers' cellular connections.
- Isolate OT from business networks.
- Change passwords and use phishing-resistant MFA (the agencies' guidance). Danfoss and Cato Networks commentary adds replacing default and shared passwords.
- Keep firmware current and retire end-of-life equipment.
- Allowlist authorized devices and IP addresses.
- Keep tested offsite and offline backups.
- Enable logging, and collect network traffic where OT assets lack logs.
- Set safe temperature limits downstream of controllers, with deviation alerts, and use independent temperature monitoring.
- Secure necessary remote access through firewalls or edge devices.