Overview
CISA, the FBI, HHS, USDA, and DOT have issued a joint advisory warning that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide. The stated aims are service disruption, fire hazards, and inventory loss. The attackers have not been identified.
What Attackers Are Doing
The agencies say actors exploit unpatched or internet-exposed controllers through:
- Authentication bypasses
- Arbitrary code injection
- Weak or default configurations
Once in, they remotely change settings to force units into continuous heating or defrost cycles. Denial-of-service attacks can also remove operators' visibility into current temperatures.
Observed Incidents
- Hundreds of supermarkets across Europe were hit, with temperatures raised as high as 50°C (122°F) or cooling forced into defrost. Targets ranged from large chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the UK.
- The French Blood Establishment (EFS) reported that an incident at a refrigeration equipment provider raised temperature and defrost settings to "extremely high levels" at three blood plasma storage facilities.
Exposure
Censys data cited in the report shows two named product lines still reachable online:
| Product | Exposed (Oct 9) | Exposed (Nov 5) |
|---|---|---|
| Danfoss StoreView | 3,004 | 708 (mostly France) |
| Copeland/Dixell XWEB | 3,708 | 2,420 |
Impacts
- Shortened equipment life and fire hazards
- Spoiled food and financial loss
- Risk to consumers who buy products stored unsafely
- Loss of temperature visibility
Recommended Mitigations
- Identify every refrigeration and monitoring system reachable from the internet.
- Remove unnecessary remote access and secure what remains, ideally behind a VPN with MFA.
- Change default passwords and use strong authentication.
- Isolate OT devices from IT networks.
- Keep firmware updated, and retire and replace legacy devices.