CISA and the FBI warn that refrigeration-controller attacks can cause fires and inventory losses

November 5, 2026. The CISA, FBI, HHS, USDA, and DOT publish a joint fact sheet warning that threat actors are targeting industrial refrigeration and cold-chain monitoring systems worldwide. 50 °C. The temperature attackers have pushed cold rooms in hundreds of European supermarkets to in recent weeks. 708. The number of Danfoss StoreView instances still exposed to the Internet as of November 5, down from 3,004 a month earlier. Why it matters: the cold chain has become an attack surface that can start fires and destroy inventory, and it is counted in thousands of controllers plugged directly into the Internet.

A goal that goes beyond data theft

The agencies’ finding is unambiguous. Attackers exploit authentication bypasses, arbitrary code injection, and weak configurations to seize electronic temperature controllers and commercial refrigeration controllers in retail and cold-storage facilities. The goal is not to exfiltrate data but to remotely alter settings and force units into continuous heating and defrost cycles.

The documented effects come in three forms. A change of temperature can shorten the system’s service life, create a fire hazard, cause inventory loss, or harm consumers who buy products stored unsafely. A loss of visibility into temperatures, through denial-of-service, strips the operator of the one alarm signal that allowed them to react in time.

Brett Leatherman, operations director of the FBI Cyber Branch, put it plainly: these systems “protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors.” And he added: “We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk.”

A European wave that has already hit French healthcare

The federal alert is the visible part of a very real campaign. In recent weeks, actors targeted hundreds of supermarkets across Europe by exploiting weaknesses in Internet-accessible refrigeration controllers, raising temperatures as high as 50 °C (122 °F) or forcing cooling units into defrost mode. The result: spoiled food and financial losses across thirteen countries — from Belgium to Estonia, through Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the United Kingdom.

Among the victims is the French Blood Establishment (Établissement français du sang, EFS). The establishment confirmed that a cybersecurity incident affecting a refrigeration-equipment provider had pushed temperature and defrost settings to “extremely high levels” at three facilities used to store blood plasma. The identity of whoever is behind the spree is unclear.

That case changes the gravity of the equation. Spoiling yogurt is expensive; altering blood plasma is a public-health matter. The cold chain is not a mere logistics asset — it is a sanitary safety link that digitalisation has made remotely operable, and therefore remotely attackable.

The economics sharpen the warning. Cold-chain inventory is perishable and uninsurable in real time: a single night at 50 °C can destroy a full load of vaccines, blood products, or produce before anyone notices, and the loss compounds with every hour of lost visibility. For a supermarket chain, the damage is margin; for a blood establishment, it is therapeutic safety. That is precisely why the agencies frame the threat not as a data breach but as a safety event — the attacker is not stealing records, they are turning the refrigeration equipment itself into a weapon, and the harm is measured in degrees Celsius and spoiled inventory.

Exposure counted in thousands of controllers

Censys data gives the problem its scale. As of November 5, 2026, hundreds of Danfoss StoreView instances remained exposed worldwide, mostly in France, even though the count had dropped from 3,004 to 708 between October 9 and November 5. Copeland/Dixell XWEB exposure followed the same slope, from 3,708 to 2,420.

The attack-surface-management platform places the wave in a wider series of recent incidents targeting critical infrastructure: gas-station tank gauges, air-raid systems, and water towers. It also offers one structural figure: North America accounts for roughly 38 % of global industrial control system (ICS) exposure. Asia’s share rose from 22 % in 2024 to 25 % in 2026, while Europe’s fell from 36.5 % to 32 % — shifts that produced no overall decline. “ICS exposure is a problem that’s been reported on and warned about for years,” Censys concludes: it remains a critical public risk.

An IT/OT convergence that changes the nature of the risk

The federal alert is first and foremost a signal about IT/OT convergence. For decades, industrial control systems lived in physically isolated networks, protected by obscurity. The digitalisation of the cold chain — connected sensors, telemetry, remote supervision — abolished that isolation without always replacing it with a perimeter. The result: a refrigeration controller built for a technical cabinet ends up reachable from the Internet, with default credentials and firmware that was never updated.

Censys figures show the awareness is real but insufficient. The drop in Danfoss StoreView instances from 3,004 to 708 in one month proves operators reacted — likely by closing exposure after the European incidents. But 708 instances still exposed is still 708 entry points into equipment capable of heating to the point of fire. And the shift in regional shares — Asia climbing, Europe falling — suggests the problem is migrating rather than disappearing.

The agencies’ recommendations deserve to be read as a defence-in-depth strategy, not a checklist. Strong authentication and default-password removal answer the most common vector. Identifying Internet-accessible systems answers the most forgotten one — the involuntary exposure of a supervision port left open by an integrator. And retiring end-of-life equipment answers the sneakiest risk: a controller no one patches anymore, but no one unplugged either.

Verdict

If you run a cold-storage warehouse, a store, or a healthcare site with temperature controllers, treat this CISA fact sheet as a marching order, not a briefing. Start by identifying every system reachable from the Internet — the Danfoss StoreView and Copeland/Dixell XWEB exposure shows that is where the attack enters — then remove any unnecessary remote access and secure the access you keep behind a VPN or bastion host. Isolate OT equipment from the corporate network, change default passwords, update firmware, and retire end-of-life devices the vendor no longer patches. If you are an integrator, the advice carries over to your clients: a refrigeration controller has no legitimate reason to be reachable from the Internet, and its online presence is now a likely indicator of compromise, not a convenience setting. The lesson fits one line: once a thermostat becomes remotely operable, it also becomes a weapon — and the defence starts by unplugging it from the public network.

References

• CISA — “US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems” (joint CISA/FBI/HHS/USDA/DOT fact sheet, November 5, 2026)
• The Hacker News — “U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses” (Ravie Lakshmanan, November 9, 2026)