US agencies warn of attacks on refrigeration controllers
November 9: Help Net Security reports a separate Ransom-ISAC case using factory Administrator credentials to push setpoints to 110°C and 150°C; NoName057(16) and Z-Pentest claims remain unconfirmed.
Agencies urge isolating exposed cold-chain controllers after temperature tampering hit European stores, French blood sites, and US military commissaries.
CISA, the FBI, HHS, USDA, and DoT warned on November 5 that actors are targeting industrial refrigeration controllers in healthcare, food, chemical, and transportation. Attackers altered temperatures at European supermarkets, raising some units to 50°C and forcing heating or defrost cycles, spoiling food and in some cases causing fires. Three French blood and plasma sites were briefly overheated on November 2, and WIRED reports at least six US military commissaries were hit in August; staff limited blood-product damage. Agencies say actors may use authentication bypass, code injection, or weak settings on exposed unpatched Danfoss and Copeland/Dixell devices, and urge internet isolation, OT segmentation, patches, password changes, and offline backups. TechCrunch says a possible Iran link is unofficial; WIRED says investigators are also examining possible Russian ties.
- Advisory covers healthcare, food, chemical, and transportation operators.
- SecurityWeek: October 11 attacks set fridges to 50°C and freezers to defrost.
- BleepingComputer: earlier attacks disrupted 250–350 French supermarkets.
- A later wave hit over 100 supermarkets and one blood bank.
- Censys exposure fell 35% for XWEB and 76% for StoreView.
- Report incidents to CISA or the FBI and keep offline backups.
Timeline
dated events in the reporting · oldest first- Oct 11, 2026Supermarket fridges set to 50°C; freezers defrosted · SecurityWeek
- Nov 2, 2026French blood-storage rooms briefly raised to high temperatures · WIRED
- Nov 2, 2026Ransom-ISAC case pushed setpoints to 110°C and 150°C · Help Net Security
- Nov 5, 2026US agencies issued joint refrigeration hardening warning · CISA Advisories
What each outlet adds
beyond the shared facts- SecurityWeekOctober 11 50°C changes and Censys exposure drops
- WIREDSix August commissaries, Danfoss firmware, possible Russian ties
- BleepingComputerEarlier wave disrupted 250–350 French supermarkets
- TechCrunchPossible Iran link is not an official attribution
- Help Net SecurityUnconfirmed gang claims and 110°C setpoint case
- CVEs
- CVE-2026-25085
- Products
- StoreViewXWEBindustrial refrigeration and cold chain monitoring systemsindustrial refrigeration controllersrefrigeration controllersrefrigeration unitscold chain monitoring systemsXWEB PROstoreviewxwebindustrial refrigeration systemselectronic temperature controllers
- Victims
- French Blood Establishmentsupermarkets in EuropeEtablissement Français du Sangsupermarkets in Europe and US military basessupermarketsmilitary basesblood banksgrocery store operatorsrefrigeration operators
Coverage
oldest first · one row per article · UTC- · 4d ago
CISA AdvisoriesFirst report
CISA Urges Hardening of Industrial Refrigeration Systems
Malicious actors may exploit vulnerabilities in refrigeration controllers to alter temperatures and cause inventory loss.
- · 3d ago
TechCrunch · Security
U.S. Government Warns of Ongoing Cyber Threat to Freezers
CISA warns of cyberattacks on industrial refrigeration units that could change temperatures and cause physical damage in supermarkets, military bases, and blood banks.
- · 3d ago
The Register · Security
US agencies warn grocery operators on industrial freezer hacking risks
Attacks in Europe have raised fridge temperatures to 50°C spoiling food and risking fires; US operators urged to disconnect systems from the internet.
- · 3d ago
BleepingComputer
FBI and CISA warn of refrigeration system cyberattacks
Hackers target industrial refrigeration controllers worldwide; agencies urge removal from internet and patching to prevent food spoilage and equipment damage.
- · 3d ago
Help Net Security
US agencies warn of attacks on refrigeration systems
CISA and FBI urge operators to disconnect controllers from the internet and implement mitigations to prevent temperature manipulation in food and medicine storage.
- · 3d ago
SOCRadar
Refrigeration cyberattacks draw FBI and CISA warning
The FBI and CISA issued a warning about cyberattacks targeting refrigeration systems.
- · 3d ago
SecurityWeek
US Agencies Urge Hardening of Refrigeration Controllers
Attackers have tampered with European supermarket fridges and blood banks, prompting US agencies to urge internet isolation and OT device hardening.
- · 2d ago
WIRED · Security
Internet refrigerators hit by temperature attacks in Europe and US bases
Widespread attacks on exposed refrigeration controllers raised temperatures in blood banks and supermarkets across Europe and US military bases; systems were quickly detected and no data was altered.
- · 10h ago
The Hacker News
U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses
Attackers exploit unpatched controllers in European supermarkets, raising temperatures to 50°C and spoiling inventory.
- · 9h ago
Cyber Security News
U.S. Agencies Warn of Hackers Targeting Industrial Refrigeration
The November 5 warning urges operators to secure exposed controllers before attackers can change temperatures, damage equipment, or disrupt storage operations.
- · 6h ago
GBHackers
CISA and FBI Warn of Cyberattacks on Industrial Refrigeration Systems
Joint advisory highlights risks to cold chain monitoring in healthcare and food sectors.
- · 1h ago
Copeland XWEB controllers hijacked for spam and proxy traffic
SecurityScorecard linked three XWEB PRO units to coordinated outbound spam and only suspects CVE-2026-25085.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-25085 | A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed… | 9.8 | <1% |