US agencies warn of attacks on exposed refrigeration controllers
First merged summary.
US agencies urge operators to isolate internet-exposed refrigeration controllers after European supermarket and blood-storage attacks.
CISA, the FBI, HHS, USDA and DOT warned on November 5 that attackers are targeting industrial refrigeration and cold-chain controllers used for food, medicine and other storage. Attackers changed settings or forced defrost and heating cycles on exposed Danfoss, Dixell and Copeland systems, spoiling inventory and in some cases damaging equipment or starting fires. Dark Reading reports an October 11 wave hit roughly 700 French stores; Unit 42 counts about 800 supermarkets and medical facilities, with a November expansion beyond France. French blood-storage rooms were briefly overheated on November 2; WIRED says alarms prevented sample damage. NoName057(16) and Z-Pentest claimed responsibility, which Unit 42 says is unverified. Agencies urge disconnecting controllers from the internet, changing default passwords and updating or replacing end-of-life devices.
- Named systems include Danfoss AK-SM and AK-SC and Copeland/Dixell XWEB controllers.
- Some Danfoss units accepted username admin and the current date as the password.
- Investigators have not publicly confirmed the initial access vector.
- Unit 42 identified more than 5,000 exposed devices in France.
- WIRED reports incidents in 11 European countries and at US military commissaries.
- Temperatures reached 50°C in some stores, according to several outlets.
Timeline
dated events in the reporting · oldest first- Oct 11, 2026Unknown attacker forced long defrost cycles at French supermarkets. · Dark Reading
- Nov 2, 2026Three French blood and plasma sites were briefly overheated. · WIRED
- Nov 5, 2026Five US agencies issued a joint refrigeration-controller warning. · Cyber Security News
What each outlet adds
beyond the shared facts- Dark ReadingOctober 11 timing, default date password, and unconfirmed access vector.
- Unit 42Unverified hacktivist claims, about 800 sites, and 5,000 exposed devices.
- WIREDBlood samples spared; military commissaries; possible Russia or Iran ties.
- Security AffairsENISA response and named French supermarket chains.
- TenableANSSI investigating named controller families since mid-October.
- CVEs
- CVE-2026-25085
- Products
- StoreViewXWEBindustrial refrigeration and cold chain monitoring systemsAK-SMAK-SCindustrial refrigeration controllersrefrigeration controllersrefrigeration systemsDanfoss refrigeration controllersXWEB PROstoreviewxweb
- Victims
- French Blood Establishmentsupermarkets in EuropeEtablissement Français du Sangsupermarkets in Europe and US military basessupermarketsmedical facilitiesIntermarchéNettoCoopérative Ublood banks
Coverage
oldest first · one row per article · UTC- · 6d ago
BleepingComputerFirst report
FBI and CISA warn of refrigeration system cyberattacks
Hackers target industrial refrigeration controllers worldwide; agencies urge removal from internet and patching to prevent food spoilage and equipment damage.
- · 6d ago
Help Net Security
US agencies warn of attacks on refrigeration systems
CISA and FBI urge operators to disconnect controllers from the internet and implement mitigations to prevent temperature manipulation in food and medicine storage.
- · 6d ago
Security Affairs
ENISA Warns of Cyberattacks on European Refrigeration Systems
Attacks on French supermarket refrigeration destroyed food stocks using Danfoss controllers.
- · 6d ago
SOCRadar
Refrigeration cyberattacks draw FBI and CISA warning
The FBI and CISA issued a warning about cyberattacks targeting refrigeration systems.
- · 6d ago
SecurityWeek
US Agencies Urge Hardening of Refrigeration Controllers
Attackers have tampered with European supermarket fridges and blood banks, prompting US agencies to urge internet isolation and OT device hardening.
- · 6d ago
Dark Reading
Freezer-control hacks disrupt about 700 French supermarkets
An October 11 attack forced long defrost cycles on Danfoss, Dixell and Copeland systems, causing millions of euros in damage.
- · 6d ago
Palo Alto Unit 42
Hacktivists claim attacks on European supermarket refrigeration systems
Hacktivists claimed responsibility for raising refrigeration temperatures to 50°C in hundreds of European supermarkets and medical facilities.
- · 5d ago
WIRED · Security
Internet refrigerators hit by temperature attacks in Europe and US bases
Widespread attacks on exposed refrigeration controllers raised temperatures in blood banks and supermarkets across Europe and US military bases; systems were quickly detected and no data was altered.
- · 3d ago
The Hacker News
U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses
Attackers exploit unpatched controllers in European supermarkets, raising temperatures to 50°C and spoiling inventory.
- · 3d ago
Cyber Security News
U.S. Agencies Warn of Hackers Targeting Industrial Refrigeration
The November 5 warning urges operators to secure exposed controllers before attackers can change temperatures, damage equipment, or disrupt storage operations.
- · 3d ago
GBHackers
CISA and FBI Warn of Cyberattacks on Industrial Refrigeration Systems
Joint advisory highlights risks to cold chain monitoring in healthcare and food sectors.
- · 3d ago
Copeland XWEB controllers hijacked for spam and proxy traffic
SecurityScorecard linked three XWEB PRO units to coordinated outbound spam and only suspects CVE-2026-25085.
- · 3d ago
Tenable Blog
US agencies urge hardening of industrial refrigeration after EU attacks
Attackers remotely changed cold-chain temperatures at French blood banks and European supermarkets, spoiling goods and triggering fires.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-25085 | A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an unexpected return value from the authentication routine is later on processed… | 9.8 | <1% |