Refrigeration Controller Attacks Prompt CISA and FBI Warning

Refrigeration controller attacks have moved from a French supermarket incident to a formal US warning. On November 5, 2026, CISA, the FBI, HHS, USDA and the Department of Transportation published a joint fact sheet saying attackers worldwide are targeting internet-reachable electronic temperature and refrigeration controllers. The warning followed a second European wave on November 1 and 2 and an incident at three French blood storage sites. If you run cold storage, take controller panels off the internet and change default passwords this week.

What happened in the refrigeration controller attacks

The first wave hit French supermarkets on the night of October 11 to 12. Attackers reached refrigeration controllers, switched units into defrost mode and drove temperatures as high as 50°C (122°F). Estimates of the number of stores differ widely: BleepingComputer reported 250 to 350 French supermarkets, while Unit 42 put the figure at about 700. We covered that wave in our report on the French supermarket refrigeration attacks.

The second wave ran overnight on November 1 to 2 and spread beyond France. BleepingComputer counted more than 115 stores across six European countries; Unit 42 described 100 to 115 retail locations in at least 10 more countries. Some systems shut down entirely and others reached 50°C, and Unit 42 reports that some incidents caused fires.

In the Netherlands, the attacks arrived on November 2. Malwarebytes, citing Dutch broadcaster NOS, reported that at least 17 businesses had their refrigeration systems compromised, mostly butcher shops and small neighborhood stores. Large supermarket chains were reportedly unaffected.

On November 3, the French blood service (EFS) confirmed an incident at a refrigeration equipment provider that changed temperature and defrost settings at three facilities storing blood products. Staff intervened before any blood products or samples were compromised, and Unit 42 found no evidence that blood products were spoiled.

Also on November 3, the pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility on Telegram. Unit 42 notes those claims are unverified.

What the US agencies said

The joint fact sheet, titled "US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems," describes malicious actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. It names four sectors that rely on these systems: Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems, including refrigerated transport.

The agencies list three weakness types the actors use: authentication bypass, arbitrary code injection and weak configurations. The fact sheet does not name a vendor, product or CVE.

FBI Cyber Branch Operations Director Brett Leatherman said the systems are being targeted across critical infrastructure sectors globally. CISA's Chris Butera told organizations that depend on these controllers to assume they could be targeted.

Who is affected

Any organization with refrigeration or temperature monitoring controllers reachable from the internet is in scope. That includes grocers and convenience stores, cold storage warehouses, food processors, pharmacies and hospitals, blood and tissue banks, laboratories, chemical storage and refrigerated fleets.

Small sites carry the most risk. The Dutch victims were butcher shops and neighborhood stores, the kind of business where a refrigeration contractor installs the controller and nobody in IT knows it exists.

Exposure is falling but still large. Unit 42 counted more than 5,000 internet-exposed devices from the manufacturers named in the French CERT-FR alert on November 5 and 6, while stressing that exposure does not prove a device is vulnerable. In France the count dropped from 1,853 in the first half of October to 558 in the second half and 316 in early November.

Technical analysis

The initial access vector for both European waves is still unconfirmed. Unit 42 says speculation centers on outdated software and default manufacturer credentials that are easy to find.

The vendor's own account points the same way. Danfoss advised its Dutch customers on October 13 to disconnect systems from the public internet and reconnect only through a secure network. A Danfoss spokesperson told NOS that the affected systems were still reachable through unsecured connections and used default passwords, and that the attacks could have been prevented had the recommended precautions been taken.

The agencies describe two classes of impact. The first is physical: temperature changes that destroy inventory, shorten the equipment's service life, create fire hazards and can indirectly harm consumers through unsafe storage. The second is a loss of visibility into current temperatures, which the fact sheet calls a denial-of-view condition. Operators who rely on the same controller for both control and monitoring may not see the problem until product is already lost. Our explainer on what a denial-of-view attack is in OT systems covers why that second effect matters.

What to do now

The fact sheet asks owners and operators to act immediately. Its measures, in order of urgency for most sites:

Remove internet exposure. Keep controllers and controller panels off the public internet. If remote access is required, put it behind a firewall or edge device that runs the latest version.
Change default passwords. Replace them with strong, unique passwords and use phishing-resistant MFA where the device supports it.
Isolate OT devices. Put controllers on a dedicated VLAN, separate from the business network.
Restrict who can make changes. Use device and IP address allowlists so only authorized systems can write settings.
Patch and plan replacements. Keep firmware current, and identify, retire and replace end-of-life controllers.
Review setpoint ranges. Define reasonable limits for each unit and alert on deviations. We walk through this in how to set refrigeration setpoint limits and alerts.
Log and monitor. Enable logging and review it. Where a controller has no usable logs, capture the network traffic to and from it.
Keep tested backups. Store controller configurations offsite and offline, and test restoring them.

Ask your refrigeration contractor three direct questions: which of our controllers are reachable from the internet, what credentials are on them, and who can log in remotely. If you already inventoried contractor-installed devices after the first wave, as described in how to inventory the OT controllers your facilities contractors put online, re-check that list against what is reachable today.

Report suspicious activity to CISA (contact@cisa.dhs.gov or 1-844-729-2472) or to the FBI through ic3.gov. Healthcare operators can also report supply chain disruptions to HHSCyber@hhs.gov.

What to watch next

Watch for a confirmed initial access vector from Danfoss, CERT-FR or the agencies, and for any CVE tied to the attacks. Also watch whether anyone verifies the hacktivist claims, and whether the agencies report confirmed incidents in the United States. So far the fact sheet describes targeting, not named US victims.

Plan for the controller to fail even after you harden it. A site that can hold temperature for a few hours without the controller, and knows when to move or discard product, loses far less. Our guide on why cold storage sites need a manual fallback plan sets out what that plan should cover.