CISA and FBI Warn of Attacks Targeting Industrial Refrigeration Systems
US agencies issue joint advisory detailing cyber threats to industrial refrigeration and cold chain monitoring systems, citing incidents that destroyed food and medical supplies.
CISA and the FBI, along with other federal agencies, have issued a joint advisory alerting organizations to malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems worldwide. The warning comes in response to a series of recent incidents where attackers have gained access to internet-connected refrigeration systems, manipulating temperatures with potentially devastating consequences.
These attacks can lead to significant real-world impacts, including the spoilage of food and medical supplies. In one notable incident on October 11, 2026, supermarket chains across Europe were forced to discard inventory after hackers compromised systems managed by refrigeration provider Danfoss, setting temperatures as high as 50°C (122°F). A similar event on November 1 affected supermarkets in at least nine European countries. More recently, the French National Blood Service (EFS) experienced a cyber-attack that caused cold storage rooms to reach extreme temperatures of 110°C (230°F).
The US advisory, released on November 5, urges operators and owners of refrigeration systems, particularly in critical sectors such as healthcare, food, agriculture, transportation, and chemical industries, to remain vigilant. These systems are widely used for automated temperature monitoring, logging, defrost cycles, and energy optimization, making them attractive targets.
According to the advisory, threat actors may exploit vulnerabilities in unpatched or internet-accessible controllers to remotely alter settings, forcing units into continuous heating or defrost cycles. This can result in widespread inventory loss and create equipment hazards. Attackers are noted to employ techniques such as authentication bypass, arbitrary code injection, and leveraging weak configurations to achieve remote access to these exposed systems.
In response to these observed threats, the agencies have outlined immediate mitigation actions for security teams. Key recommendations include ensuring control system devices are not exposed to the internet, using firewalls and updated edge devices for necessary remote access, and isolating operational technology (OT) devices from business networks. Furthermore, organizations are advised to change default passwords, implement strong authentication policies including phishing-resistant multi-factor authentication (MFA), and establish a structured lifecycle management process for legacy devices.
CISA's acting executive assistant director for cybersecurity, Chris Butera, emphasized the broad applicability of the threat, stating, "Every organization that depends on refrigeration and monitoring systems should assume it could be a target." He urged immediate review of the joint fact sheet and action to close known security gaps.
Data from Censys, published on November 5, indicates a significant reduction in internet-exposed refrigeration controllers for Danfoss StoreView and Copeland/Dixell XWEB products, following the incidents. This decrease is attributed to provider actions or owners disconnecting devices, suggesting a response to the heightened risk. As of the advisory's release, no specific threat actor has been officially linked to these attacks.
This updated advisory from CISA, the FBI, and international partners provides further details on the attacks targeting industrial refrigeration and cold-chain monitoring systems. It highlights that attackers exploited unsecured connections and default passwords to alter temperatures, posing a risk to essential supplies. The agencies are now recommending specific actions such as isolating systems, implementing strong authentication, and patching firmware to prevent future incidents.
The advisory from CISA, FBI, HHS, USDA, and DoT specifically warns that threat actors may exploit vulnerabilities such as authentication bypasses, code injection, and weak configurations to gain access to management systems. These systems can then be used to tamper with temperature settings or cause denial-of-view conditions, leading to inventory loss and equipment hazards. Internet intelligence firm Censys noted a significant drop in internet-exposed refrigeration controllers, with exposure decreasing by 53% between early October and early November.