US Agencies Warn of Attacks on Refrigeration Controllers

U.S. agencies are warning that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, with the aim of disrupting service, creating fire hazards and spoiling inventory. The Hacker News reported the joint advisory on November 9, 2026. It comes from CISA, the FBI, HHS, USDA and DOT.

What the advisory says

According to the advisory, the actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely change settings and push units into continuous heating and defrost cycles. The agencies list authentication bypasses, arbitrary code injection and weak configurations as the likely routes in. The stated effects are altered temperatures (which can shorten equipment life, create a fire hazard, cause inventory loss or harm consumers buying improperly stored goods) and loss of temperature visibility through denial of service.

FBI Cyber Branch Operations Director Brett Leatherman said the systems are being targeted across critical infrastructure sectors globally.

What has already happened

In recent weeks, hundreds of supermarkets across Europe were hit through internet-accessible refrigeration controllers, according to the report. Temperatures were raised in some cases to as high as 50 degrees Celsius (122 degrees Fahrenheit), or units were forced into defrost mode. Targets ranged from large chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden and the U.K.

The French Blood Establishment confirmed that an incident at a refrigeration equipment provider raised temperature and defrost settings to “extremely high levels” at three facilities storing blood plasma. Who is behind the activity is unclear.

Exposure numbers

Censys data cited in the report shows hundreds of Danfoss StoreView instances still exposed, mostly in France, down from 3,004 to 708 between October 9 and November 5, 2026. Exposure of Copeland/Dixell XWEB fell from 3,708 to 2,420 over the same kind of window. Censys also noted that North America accounts for roughly 38% of global ICS exposure.

What to do

The agencies urge owners and operators to:

• Use strong authentication and change default passwords.
• Keep systems updated and retire or replace legacy devices.
• Identify which systems are reachable from the internet, and isolate OT devices from them.
• Remove unnecessary remote access and secure what remains.

Analysis

This is the same mistake, different decade: a device built to sit quietly in a back room gets a web interface, someone connects it for convenience, and nobody inventories it again. The exposure counts falling by thousands in a month suggests operators are reacting, but the remaining numbers are still large. Treat any controller you cannot account for as the first thing to check.

For background on the wider pattern, see our ICS/OT coverage, including the Siemens IOT2050 Node-RED exploitation report and the NCSC warning on attacks against UK critical infrastructure.