Cold Chain Cyberattack Warning: CISA and FBI Say Refrigeration Controllers Are Being Targeted, What Is Confirmed and What to Check

US agencies warned on November 5, 2026 that attackers are going after the controllers that run industrial refrigeration and cold chain monitoring. If your business stores food, medicine or chemicals at temperature, a controller reachable from the internet could let someone change its settings or stop you seeing the real temperature.

CISA, the FBI, HHS, USDA and the Department of Transportation signed the joint fact sheet. It names no product, victim or attacker. French authorities and the equipment makers have filled in part of the picture.

What is the CISA cold chain cyberattack warning?

The agencies say they are aware of malicious activity against these systems "globally," focused on electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. They say the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors widely use these systems, including in refrigerated transport.

The fact sheet says attackers may use authentication bypass, arbitrary code injection or weak configurations to force units into continuous heating and defrost cycles. It lists possible results: lost inventory, a fire hazard, shorter equipment life, harm to consumers if products are eaten after unsafe storage, and a loss of visibility into current temperatures.

"Every organization that depends on refrigeration and monitoring systems should assume it could be a target," Chris Butera, CISA's Acting Executive Assistant Director for Cybersecurity, said in the CISA release.

What is confirmed about the refrigeration attacks, and what is not

Le Quotidien du Médecin, citing French press, names the blood service's supplier as Coolworld. Coolworld said only a limited number of its units were affected and blamed a third-party component.

Which refrigeration controllers are affected, and the versions to check

One caution: neither CISA nor CERT-FR ties these CVEs to the attacks. CISA's February advisory said no known public exploitation had been reported at that time. Patching still matters, but CERT-FR warns that keeping an unpatched, end-of-life unit on the internet carries a very high risk of compromise.

How many refrigeration systems are exposed to the internet?

Forescout's October 22 report, based on Shodan searches, found 12,976 exposed service observations across 6,017 public IP addresses in 99 countries and territories. That counts services, not devices. It includes 7,075 Copeland or Dixell XWEB services. Of the exposed Danfoss AK-SM 800A StoreView services, 3,762 (80%) ran firmware older than 4.3.1.

Why a refrigeration controller is a business network problem

These boxes often sit outside the IT team's view. Forescout notes that manufacturer documentation showed internet-based remote maintenance as a supported setup, so exposure is not only an accident. Your refrigeration contractor may have set it up that way.

The cost lands on the business: spoiled stock, equipment hazards and hard questions about whether a product stayed safe. At the French blood service, Le Quotidien du Médecin reports that an on-call technician spotted the problem and alarms helped protect the stock. Monitoring only helps if someone receives the alert and can act on it.

What to do this week: cold chain security checklist

1. List every controller and who can reach it remotely, including contractors.
2. Test from outside. Copeland's method: on a phone with Wi-Fi off, enter the site's public IP address in a browser. The login page must not appear.
3. Remove exposure. No port forwarding, DMZ or direct public IP. Restore access only through a secure VPN or protected network. CERT-FR says filtering by contractor IP address is an emergency stopgap only.
4. Review the full configuration, especially defrost schedules, setpoints and alarm thresholds.
5. Check product temperatures directly in the units. Copeland warns that altered setpoints or alarm thresholds can compromise food safety.
6. Update firmware and identify end-of-life units for replacement.
7. Fix credentials. Change default passwords, give each person a named account, change passwords after contractor visits, and use phishing-resistant MFA where feasible.
8. Separate the network. Put controllers on a dedicated VLAN, away from office, point-of-sale and guest Wi-Fi, and allowlist the devices and IP addresses allowed to make changes.
9. Set limits and test alarms. Define safe setpoint ranges, alert on deviations, and trigger a test alarm to confirm it arrives.
10. Keep backups current, offline and tested.

If you suspect a compromise, isolate the unit first and screenshot its users, profiles and settings, as Copeland advises, before restoring it. US organizations can report to CISA at 1-844-729-2472 or contact@cisa.dhs.gov, or to the FBI through IC3 or a local field office.

Cold chain cyberattack questions people are asking

Are refrigeration systems being hacked right now?

CERT-FR said in October that attack campaigns were probably still under way, and US agencies warned of malicious activity on November 5.

Which brands of refrigeration controllers were hit?

CERT-FR names Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb. The US fact sheet names no brands, so other products should not be assumed safe.

Is my food or medicine unsafe if a controller was changed?

Not automatically. A changed setting does not prove what the product experienced. Measure actual temperatures and follow your own food safety or quality procedures.

Will a factory reset fix a hacked refrigeration controller?

No. CERT-FR says a factory reset alone is insufficient because the unit stays vulnerable. Remove internet exposure, reconfigure it and apply the manufacturer's security practices.

Does the CISA refrigeration warning apply outside the US?

Yes, the activity is described as global. The reporting contacts in the fact sheet are for US organizations.

The bigger lesson

The equipment protecting your inventory now has a login page, and it may have been installed by someone who never spoke to your IT team. Find out what is connected, who can reach it, and who gets the call when a temperature moves.

Need help finding and locking down connected equipment? See our security hardening services or request a quote.

Get security alerts by email, with our free checklist, at EPE Security Alerts.

Sources: CISA joint fact sheet; CISA release; CERT-FR CERTFR-2026-ALE-012; Copeland bulletin and Dixell France guidance; CISA ICSA-26-057-10; Claroty on Copeland XWEB Pro; Claroty on Danfoss AK-SM 800A; Forescout; Le Quotidien du Médecin.