Cold Chain Cyberattacks: FBI and CISA Warn Refrigeration Controllers Are Being Targeted, What France Confirmed and What to Check This Week

Attackers have been remotely changing the settings on commercial refrigeration controllers, and France says one overnight attack in October caused food losses estimated at several tens of millions of euros. If your business keeps food, medicine or chemicals cold, five US agencies are now urging you to close the gaps on your temperature controllers immediately.

What happened in the cold chain cyberattacks

• Oct. 11 to 12, France. The full report (PDF) from France's Cyber Crisis Coordination Centre (C4) says refrigeration controllers at about 700 retail sites were compromised overnight. Defrost settings were changed to high temperatures, causing major stock losses and at least 15 fire starts. The same PDF names Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché among the groups affected, plus butcher shops, a slaughterhouse and cooperative food plants.
• Oct. 12, French alert. CERT-FR's alert, last updated Oct. 16, reports numerous compromises of Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb devices. It warns that campaigns are probably still under way.
• Nov. 1 to 2, European Union. A joint EU statement dated Nov. 4 describes a new wave of incidents in "a number of EU Member States." It names none of them.
• Early November, French blood service. In an FBI video, also reported by The Cyber Express, FBI Cyber head Brett Leatherman says attackers went after refrigeration at three national blood service sites in France. Alarms reached the right people, staff responded, and no blood was lost.
• Nov. 5, United States. CISA, the FBI, HHS, USDA and the Department of Transportation published a joint fact sheet.

How are hackers getting into refrigeration systems?

The FBI's short answer, from that video, is that attackers are getting in through controllers that are unpatched, reachable from the internet, or still using the default passwords listed in the manufacturer's manual.

The written fact sheet is more careful. It says the actors may exploit flaws through authentication bypass, arbitrary code injection and weak configurations, then force units into continuous heating and defrost cycles. Possible effects include a shorter equipment life, a fire hazard, lost inventory, harm to consumers from unsafely stored products, and a "denial-of-view" condition where operators can no longer see current temperatures.

Who is behind the refrigeration attacks? What is confirmed and what is not

What governments have stated:

• France's C4 report imputes a series of attacks to two units, Shahid Shoostari and Shahid Kaveh, inside the cyber arm of Iran's Islamic Revolutionary Guard Corps. It names Shahid Kaveh as the unit that carried out the October refrigeration attack, with the Revolutionary Guard as its sponsor. France's foreign ministry made the same attribution on Nov. 9.
• The PDF gives its basis as a body of indications: infrastructure also used to probe Schneider Electric equipment, use of the FOFA scanning tool, relay of the attack on the CyberbanNews propaganda channel by Oct. 13, and traces of Farsi in the attack infrastructure. These are France's own findings.
• The PDF also ties concurrent targeting of Schneider Electric equipment at French hydroelectric sites to the same attack, with moderate effects.

What is not established in the sources we read:

• The exact way in. CERT-FR's alert describes no entry route beyond internet exposure, and the US fact sheet does not say which method was used where.
• Who ran the later incidents. France's attribution covers the October attack and earlier operations. The C4 report does not mention the blood service, and neither the EU statement nor the US fact sheet names an attacker.
• A link to specific published flaws. CISA's February advisory on Copeland XWEB lists 23 vulnerabilities in XWEB 300D, 500D and 500B PRO at version 1.12.1 and earlier, with a top score of 10.0. At publication it said no known public exploitation had been reported to CISA. Nothing we read ties those flaws to these attacks.
• US victims. The fact sheet describes activity "globally" and does not describe a specific US incident.

Why refrigeration security matters for a business network

The fact sheet says healthcare, chemical, food and agriculture, and transportation organizations widely use these systems, including in refrigerated transport. Three problems tend to follow from that.

First, these panels often belong to nobody in IT. A refrigeration contractor may have installed one years ago with remote access for monitoring, which is the same ownership gap we covered in Who Is Patching the Software That Runs Your Business?.

Second, a settings change is a physical event. Lost stock, damaged equipment and fire risk land on operations and insurance, not only on IT.

Third, default passwords remain a real risk well beyond fridges, as our post on ForgeRock default passwords showed.

The blood service account is the useful one. By the FBI's telling, the outcome turned on alarms reaching people who acted.

What to do this week: refrigeration controller checklist

US organizations can report activity to CISA at 1-844-729-2472, or to the FBI through IC3 or a local field office. Healthcare organizations can also reach HHS at 202-619-7800. Once firmware is installed, confirm the version on the device itself: updated is not the same as patched.

Cold chain cyberattack questions people are asking

What is a cold chain cyberattack?

An attack on the systems that keep food, medicine or other goods cold in storage and transport, usually by changing or hiding temperature settings.

Can hackers really hack a refrigerator or freezer?

Commercial ones, yes, through the networked controllers that run them. The government warnings here concern industrial and commercial systems, not home kitchen fridges.

Which refrigeration controllers were targeted?

CERT-FR names Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb. The US fact sheet names no vendors, so do not assume other brands are safe.

Did default passwords cause the attacks?

The FBI lists them as one of three ways in. No source we read says how many sites were entered that way.

Has this happened in the United States?

The fact sheet warns of activity worldwide and says US sectors rely on these systems, but it does not describe a specific US incident.

Does this apply to HVAC systems?

The guidance is about refrigeration and cold chain monitoring. The same basics are still sensible for any building control panel reachable from the internet.

The bigger lesson

The controller in the back room is part of your network, whether or not anyone in IT has ever logged into it. Take it off the internet, give it an owner, and make sure a real person hears the alarm if everything else fails.

Need help finding what is exposed? See security hardening or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: CISA, FBI, HHS, USDA and DOT joint fact sheet; FBI video statement; CERT-FR alert CERTFR-2026-ALE-012; French C4 report CERTFR-2026-CTI-009 (PDF); French foreign ministry statement; EU joint statement; CISA advisory ICSA-26-057-10.