U.S. agencies warn of cyber attacks on refrigeration controllers as European supermarkets face disruption

CISA, the FBI, HHS, USDA and DOT issued a joint warning on Nov. 5, 2026, saying malicious cyber activity is taking aim at industrial refrigeration and cold chain monitoring equipment around the world.

Intruders are aiming at electronic temperature controllers and at commercial refrigeration controllers inside grocery stores and cold storage warehouses. The affected areas include health care and public health, chemicals, food production and farming, and transportation.

Bad actors can get in through unpatched or internet-facing devices, using authentication bypass and weak configurations along with arbitrary code injection. Such intrusions can let attackers change cooling setpoints, run nonstop heating and defrost cycles, hide temperature readings, spoil stock and overheat gear enough to start a fire. The agencies told operators to cut direct public internet access to control systems, separate OT from business networks, and tighten authentication with password changes and phishing-resistant multifactor authentication.

Every organization that depends on refrigeration and monitoring systems should assume it could be a target.

Chris Butera, Industrial Cyber

Brett Leatherman, the FBI Cyber Branch Operations director, said these systems keep food, medicine and other temperature-sensitive goods safe, which is what makes them appealing to intruders. Intruders broke into supermarket cooling systems in Europe on two occasions inside a three-week span.

The most recent wave hit on Nov. 2, disrupting refrigeration across at least seven countries in the European Union, and stores plus other businesses reported problems—more than 100 in all. Sabcobel, a Belgian refrigeration company, said intruders got into cooling systems and put evaporators into defrost mode, which drove temperatures up.

Danfoss said some of the targeted systems in the Netherlands stayed on unsecured networks and kept default passwords. The first incident ran overnight Oct. 11-12, when unidentified intruders remotely opened the software that controls temperatures in refrigerators, freezers and cold-storage rooms at major French supermarket chains.

In the October episode, refrigerators and freezers at hundreds of stores reportedly rose to as much as 50 degrees Celsius. A few French stores reported fires from overheating equipment. No group has claimed responsibility for the attacks in Europe, and investigators have not determined whether the incidents trace back to the same perpetrator.

The European Commission and ENISA said refrigeration systems and comparable devices in a number of EU member states have been struck by cybersecurity incidents beginning Oct. 11. After more incidents on Nov. 1-2, ENISA, DG CNECT, Europol’s EC3, the EU CSIRTs Network and EU-CyCLONe told organizations to act right away to lower exposure in the affected systems. Member states that were affected are looking into the incidents and putting out guidance, while the CSIRTs Network and EU-CyCLONe keep sharing information and watching developments.

Starting Sept. 11, makers of hardware and software products must report serious incidents and vulnerabilities under active exploitation using the Single Reporting Platform created by the Cyber Resilience Act. The CRA’s core security rules take effect Dec. 11, 2027, requiring makers to bake security into design, support products through their full life cycle, and fix vulnerabilities without delay. Groups under the NIS2 Directive must put cybersecurity risk-management measures in place and report significant incidents to a national CSIRT or the relevant authority.

Duncan Greatwood, CEO at Xage Security, said intruders took no files but simply raised the temperature, and that was enough to clear store shelves. He said the Pentagon is said to be looking into possible strikes on refrigeration systems at military commissaries. Greatwood said firms running refrigeration, production lines and other physical operations should assume attackers will get in and ensure one compromised device or credential cannot disrupt operations widely.

Guy Waizel, a tech evangelist at Cato Networks, said teams should verify whether refrigeration controllers are reachable straight from the internet, including by way of a maintenance provider’s cellular link. He said teams should swap default or shared passwords for individual accounts, demand multifactor authentication at the remote-access gateway when a device cannot handle it, and restrict who may change settings.

Waizel said teams should keep refrigeration systems apart from office networks and from other locations, and line up firmware updates with the equipment supplier. He said teams should watch for shifts in temperatures, settings and alarms, and add independent temperature monitoring so cooling failures show up even when the controller’s own alarms have been changed.

Waizel said users of Danfoss AK-SM or AK-SC controllers, or Copeland/Dixell XWEB systems, should look at the vendor’s security advice for the specific model and firmware version they run. He said public research has described flaws in the Danfoss AK-SM 800A controller and in Copeland XWEB Pro controllers, though it is not confirmed that those flaws were exploited in the reported refrigeration attacks. He said that if patches cannot be applied right away, teams should limit access and consider network-based protection against the relevant exploits while working with the equipment supplier on remediation.

The agencies told operators to keep device firmware up to date and to build a lifecycle process for finding, retiring and replacing equipment at end of life once the maker stops supporting it. The agencies also urged allowlisting, which lets only approved devices and certain IP addresses make changes, together with current offsite and offline backups that receive regular testing.

The agencies told operators to turn on logging and check logs for unexpected activity, and when OT assets do not keep standard logs, gather network traffic and traffic between those assets instead. They also said to set safe temperature limits on equipment fed by controllers and to configure alerts for any departure from those limits. The guidance lines up with the CISA and NIST cross-sector Cybersecurity Performance Goals and asks organizations to protect remote access using firewalls or edge devices and to watch OT environments regularly for suspicious activity.

On May 5, 2026, CI Fortify is built around two emergency planning aims: isolation and recovery. With isolation, OT systems are deliberately cut off from business and third-party networks so a cyber incident causes limited damage and essential services keep running even when communications degrade. Recovery covers what to do if isolation fails, such as documenting systems, backing up critical files and rehearsing how to replace systems or switch to manual operations.

CISA noted that bringing systems back may call for licensing servers and business network connections, and operators must plan specifically for those. CISA is running targeted resilience assessments that focus on defense-critical infrastructure, and a pilot phase is under way. CI Fortify tells utilities to map OT connections and dependencies, build and rehearse isolation steps, prioritize patching of externally accessible systems, enforce least-privilege access for vendors, harden defenses against spearphishing, create out-of-band communications and take part in CISA’s assessment program.

CISA published the joint guide Adapting Zero Trust Principles to Operational Technology with federal partners on April 30, 2026. The guide came from a working group across several agencies, with CISA in the lead, together with the Defense, Energy and State departments and the FBI. It is built for security practitioners and OT operators and takes on the challenges of adding zero trust architectures to settings that put continuous operation and physical safety first.

The guide calls for asset inventories built with passive monitoring, network segmentation and microsegmentation, identity and access controls fitted to older systems, safe remote access via jump hosts and multifactor authentication, and supply-chain risk management in purchasing. The guide says malicious software families including CrashOverride and BlackEnergy are able to disrupt physical processes, while living-off-the-land techniques help attackers hide in everyday activity.

This is a great guide that takes the right direction, but it dodges the hardest question, which is who pays for it?

Tatyana Bolton, BnkInfoSecurity

Tatyana Bolton, executive director of the Operational Technology Cybersecurity Coalition, said the guidance moves in the right direction but leaves unanswered the question of who foots the bill. She said many critical infrastructure owners and operators, including small ports, rural electricity co-ops and water utilities, cannot afford zero trust measures.

Kate DiEmidio, vice president of public policy and government affairs at Dragos, said resilience under zero trust means designing systems that spot intrusions, keep running safely, contain disruption and bounce back fast. Chris Grove, director of cybersecurity strategy at Nozomi Networks, said nonstop authentication cannot work for something like an emergency stop button, because no one can log in before pressing it. Patrick Miller, CEO of Ampyx Cyber, said buying is a security control and every purchase order counts as a security decision.

Alison King, vice president of government affairs at Forescout, said AI large language models can uncover vulnerabilities and chain them into exploits within minutes or hours rather than days or weeks. Dale Peterson, CEO of Digital Bond, said the CISA zero trust guidance is too broad, too general and not very useful.