US Agencies Urge Organizations to Harden Refrigeration Controllers

Five federal agencies, including CISA and the FBI, issued a joint advisory urging industrial refrigeration operators to protect cold chain equipment from cyber intrusions. According to SecurityWeek's report, the coordinated warning follows destructive cyberattacks across Europe that compromised commercial cooling systems in hundreds of retail supermarkets and threatened biological supplies stored at a major blood bank facility.

This report details the attack mechanisms, affected controller models, operational vulnerabilities, and federal hardening guidance issued for organizations managing cold storage infrastructure. Security leaders, operational technology engineers, and facility directors across the healthcare, chemical, grocery, and transportation sectors will find essential intelligence regarding exposed controller interfaces, remediation priorities, and defense-in-depth safeguards required to protect perishable inventory and cooling machinery from remote manipulation.

US Agencies Urge Organizations to Harden: what actually changed

CISA, the FBI, HHS, USDA, and the Department of Transportation issued a joint advisory warning that malicious cyber actors are targeting electronic temperature controllers and commercial refrigeration systems in grocery and cold storage facilities. In response to recent European disruptions, organizations began removing exposed management interfaces from public networks. Threat intelligence firm Censys reported that out of 6,695 internet-exposed refrigeration controllers identified on October 9, only 3,124 units remained accessible as of November 5, representing an overall drop of 53 percent in global web exposure in under a month.

This reduction in exposure centered on two widely deployed systems: Copeland/Dixell XWEB and Danfoss StoreView controllers. Censys observed that online exposure for Copeland/Dixell XWEB devices dropped 35 percent, decreasing from 3,708 to 2,420 accessible units. Exposed Danfoss StoreView management systems saw a sharper 76 percent decline, plummeting from 3,004 to 708 reachable installations. Despite this progress, thousands of industrial refrigeration controllers remain exposed online, leaving cooling systems vulnerable to unauthorized remote interference until organizations take appropriate mitigation steps.

US Agencies Urge Organizations to Harden: how it works

Attackers compromise refrigeration controllers by exploiting authentication bypasses, remote code injection vulnerabilities, and weak system configurations in internet-accessible software. Malicious actors use these flaws to access management consoles, alter operational settings, and override temperature controls. As the federal agencies warned, "The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards."

Once threat actors access controller consoles, they alter setpoints to force mechanical refrigeration equipment far outside safe operating parameters. During European attacks, intruders raised refrigerator temperatures to 50 degrees Celsius (122 degrees Fahrenheit) and forced freezers into defrost mode. Beyond spoiling perishable inventory, continuous heating causes mechanical stress that can lead to equipment fires. Hackers also triggered denial-of-view conditions on monitoring consoles, preventing on-site staff from detecting thermal anomalies before catastrophic physical or inventory damage occurred.

US Agencies Urge Organizations to Harden: why it matters

Cyber operations against commercial refrigeration demonstrate that tampering with operational technology in retail and cold storage sectors causes immediate financial devastation. On October 11, attacks struck hundreds of European supermarkets by resetting fridges to high heat and initiating freezer defrosting, spoiling extensive food stock and causing fires. The financial toll across impacted retailers climbed into millions of dollars in inventory losses and hardware damage, proving that exposed cooling controllers represent serious operational hazards for commercial facilities.

The operational danger expanded during a second wave of attacks that hit over 100 supermarkets and a blood bank facility. Intruders targeted cooling systems managed by the French Blood Establishment (EFS). While commercial grocery stores suffered substantial financial damages, rapid response by healthcare staff prevented the compromise of blood products and clinical samples. The incident underscores the severe safety risks facing healthcare networks, where unexpected thermal fluctuations can destroy lifesaving medical supplies.

US Agencies Urge Organizations to Harden: who is affected

Federal agencies identified healthcare, chemical, food, and transportation organizations as primary sectors at risk from refrigeration cyber threats. Any commercial facility operating internet-accessible temperature controllers or cold chain monitoring software is vulnerable to remote tampering. Grocery chains and centralized cold storage warehouses face elevated exposure because central controller interfaces frequently regulate dozens of discrete refrigeration units and walk-in freezers across an entire commercial site, creating single points of failure for bad actors to exploit.

Multiple threat groups have been linked to the intrusions against Danfoss and Copeland/Dixell controllers. Russian hacktivist groups Noname057(16) and Z-Pentest Alliance reportedly claimed responsibility for hacking Danfoss, prompting speculation that they conducted the supermarket attacks. However, authorities have not confirmed attribution, and reports from the BBC note that Iranian hacktivists or state-sponsored hackers may also be responsible. The activity shows that varied geopolitical actors now target critical commercial and healthcare cooling machinery.

US Agencies Urge Organizations to Harden: what to watch

Federal authorities advise that disconnecting industrial refrigeration controllers from the public internet is the most effective defensive measure organizations can take to prevent compromise. When web connectivity is strictly necessary for operational monitoring, systems must sit behind dedicated firewalls or secure edge devices. Network administrators must isolate operational technology networks from corporate IT infrastructure, ensuring management interfaces cannot be reached directly from external networks, unauthorized IP addresses, or compromised enterprise business workstations.

Organizations must also restrict controller access to trusted identities, enforcing strong password standards and phishing-resistant multifactor authentication across all administrative portals. Facility operators need to promptly update controller firmware, patch known authentication bypass and code injection flaws, maintain offsite backups of system configurations, and enable continuous logging and event monitoring. Vigilant telemetry ensures security teams can detect unauthorized setting adjustments and stop destructive heating or defrost cycles before physical equipment damage occurs.