Refrigeration Controller Hacks: CISA and FBI Warn Cold-Chain Businesses, What Is Confirmed and the Danfoss Firmware to Check
US agencies say attackers are targeting refrigeration and cold-chain controllers after two waves of store attacks in Europe. Here is what is confirmed, what is not, and what to check this week.
Where France, Belgium, Estonia, Ireland, Luxembourg, Netherlands, Sweden · Europe, Northern Europe, Western Europe, Worldwide
On this page 8 sections
On Thursday, November 5, 2026, CISA, the FBI and three other U.S. agencies warned that attackers are going after the controllers that run commercial refrigeration and cold-chain monitoring. They can change settings remotely and push units into nonstop heating and defrost cycles. If your business keeps food, medicine or chemicals at a set temperature and the controller can be reached from the internet, treat it as a target. The most important step this week is to take it off the open internet.
What happened
CISA, the FBI, the Department of Health and Human Services (HHS), the Department of Agriculture (USDA) and the Department of Transportation (DOT) published a joint fact sheet. In it they say they are "aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally." The named targets are electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. The sectors named are Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems.
The warning comes after two waves of attacks in Europe:
- France, October 2026. On October 12, France's government CERT (CERT-FR) issued an emergency alert reporting "numerous compromises" of remotely managed refrigeration controllers. It updated the alert on October 13 and 16. The alert names the Danfoss AK-SC and AK-SM series, plus Copeland XWEB and Dixell XWEB.
- Six more countries, November 2. Censys researchers report that overnight into Monday, November 2, stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden had refrigeration units raised to 50 °C (122 °F). Food spoiled in dozens of stores.
What is confirmed and what is not
| Question | What the sources say |
|---|---|
| Are refrigeration controllers being attacked? | Confirmed by the five U.S. agencies and by CERT-FR. |
| What can attackers do? | CISA lists continuous heating and defrost cycles, shorter equipment life, fire hazard, inventory loss and "denial-of-view" (staff can no longer see current temperatures). |
| How do they get in? | Not confirmed. CISA says attackers "may" use authentication bypass, arbitrary code injection and weak configurations. No agency has tied a specific flaw to a specific incident. |
| Which products? | CERT-FR names Danfoss AK-SC and AK-SM, Copeland XWEB and Dixell XWEB. For the November wave, Censys says only that "there are reports" of Danfoss StoreView involvement. |
| Who is behind it? | Unknown. Censys: "no group has claimed responsibility, and it's unconfirmed whether these were the work of the same actor." |
| Have U.S. sites been hit? | The fact sheet describes the activity as global but does not describe any specific U.S. incident. |
The known Danfoss flaws
Claroty's Team82 researchers documented three flaws in Danfoss AK-SM 8xxA series system managers. Claroty says the exposed controllers it found showed the Danfoss StoreView title on their web page. The versions below come from Danfoss's own CVE records.
| CVE | What it does | Affected | Severity |
|---|---|---|---|
| CVE-2025-41450 | Hidden "code of the day" login that gives admin access without the real password | Versions before 4.2 | CVSS v3.1: 8.2 |
| CVE-2025-41451 | Command injection in the alarm-to-mail settings, needs a login | Versions before 4.3.1 | CVSS v3: 7.6 (Claroty); CVSS v4: 8.7 (Danfoss CVE record) |
| CVE-2025-41452 | Injects settings into the web server configuration, needs a login, can crash the web interface | Versions before 4.3.1 | CVSS v3: 5.4 (Claroty) |
Claroty showed that the login bypass can be chained with the command injection to run code on the controller. Claroty's advice is to upgrade to firmware R4.3.1 or later. Censys points out that patches for several relevant flaws had been available for more than a year before the attacks. It also quotes Danfoss as saying that most affected controllers were "unsupported older models or ran outdated firmware."
To be clear, no official source has confirmed that these CVEs were the way in. What they do show is that controllers on old firmware and exposed to the internet were already a well-documented risk.
How many controllers are still exposed
Censys counted internet-exposed management interfaces between October 9 and November 5:
- Danfoss StoreView: down from 3,004 to 708.
- Copeland/Dixell XWEB: down from 3,708 to 2,420.
Censys says plainly that "the data does not show why the controllers went offline." In its November 2 analysis, Censys estimated that of the 220 French StoreView hosts still online, 41% appeared to run patched firmware. In Belgium, 68% of 138 hosts appeared to be on 4.3.1 or later. Censys inferred those firmware versions from web server headers, so treat them as estimates. Either way, every one of those devices is still on the open internet, and CERT-FR says that is exactly where these controllers should not be.
Why this matters for a business network
Refrigeration controllers are usually installed and managed by the refrigeration contractor, not by IT. They often sit on the contractor's own modem, a cellular router or a flat store network, and they rarely show up in an IT inventory. Censys found that about 70% of systems hosting industrial controls sit on consumer and mobile networks, which makes them hard to trace back to an owner.
That leaves two blind spots. Nobody on the IT side knows the device exists, and nobody owns its firmware updates. We covered that pattern in Who Is Patching the Software That Runs Your Business?. The firmware version question is the same one we raised in Updated Is Not the Same as Patched: a contractor saying the system is "up to date" is not the same as a version number you have checked.
The cost is concrete: spoiled stock, equipment damage, possible fire risk, and lost visibility into temperatures for regulated products such as medicine.
What to do this week
| Step | How to do it |
|---|---|
| 1. List every controller | Ask your refrigeration contractor for every system manager, panel and monitoring gateway, with its firmware version and how it connects (store network, contractor modem, cellular). |
| 2. Check internet exposure | Look for port forwards on your router to the controller. From a phone off your network, try the controller's public address. Ask whether any cellular modem gives it a public IP. |
| 3. Remove internet access | CERT-FR says to remove all internet exposure. Restore remote access only through a secure VPN. Filtering by the contractor's IP address is acceptable only as a short-term measure. Check your insurance and service contract before cutting the contractor's data link. |
| 4. Update Danfoss AK-SM 800A | Move to firmware R4.3.1 or later. CERT-FR also advises setting the Danfoss security level to Strict and changing default passwords. |
| 5. Check Copeland and Dixell XWEB | None of the primary sources we opened lists a specific fix tied to these attacks. Ask Copeland or your contractor for the current firmware, and take the device off the internet in the meantime. |
| 6. Replace end-of-life units | CERT-FR warns that unsupported devices left exposed have a very high probability of compromise. |
| 7. Review setpoints and defrost schedules | Check the full configuration now. CISA advises setting reasonable setpoint limits and alerting on changes outside them. |
| 8. Separate the network | Put controllers on their own VLAN, apart from business systems, and allow changes only from approved devices and addresses. |
| 9. Logs and backups | Turn on logging, back up controller configurations offline, and test that the backups can be restored. |
| 10. If a unit was tampered with | Disconnect it from the internet, restart or factory reset it, reconfigure it, and secure access before putting it back in service. CERT-FR warns that a reset alone does not stop re-compromise. |
To report an incident, contact CISA at contact@cisa.dhs.gov or 1-844-Say-CISA, or the FBI through IC3 or a local field office. HHS asks that healthcare supply chain impacts go to HHSCyber@hhs.gov.
Refrigeration controller attack questions people are asking
Are refrigeration controllers in the US being hacked?
The U.S. agencies say the activity is global and that every organization relying on these systems should assume it could be a target. The fact sheet does not describe any specific U.S. incident.
Which refrigeration controllers are affected?
CERT-FR names the Danfoss AK-SC and AK-SM series and Copeland and Dixell XWEB. The CISA fact sheet does not name any product. It covers electronic temperature controllers and commercial refrigeration controllers in general.
Is there a patch for Danfoss StoreView?
For AK-SM 8xxA system managers, the known flaws are fixed in firmware R4.3.1 or later. Older unsupported models no longer get security updates and should be replaced.
How do I know if my controller is on the internet?
Check your router for port forwards, ask your contractor how they connect remotely, and try reaching the controller from outside your network. If it loads from outside, it is exposed.
Can a hacked refrigeration controller cause a fire?
CISA lists a fire hazard as a possible effect of forcing units into continuous heating and defrost cycles.
Who is behind the cold chain attacks?
Nobody knows publicly. No group has claimed responsibility, and it is not confirmed whether the French and November attacks came from the same actor.
The bigger lesson
The riskiest devices on a business network are often the ones IT never installed. If a contractor's controller can change the temperature of your stock, it needs an owner, a known firmware version and no direct path from the internet.
We review networks and lock down exposed devices: see security hardening or request a quote.
Get security alerts by email, with the free checklist, at /security-alerts.
Sources: CISA fact sheet; CISA news release; CERT-FR alert CERTFR-2026-ALE-012; Censys exposure sitrep; Censys November 2 analysis; Censys ICS exposure analysis; Claroty Team82 research; CVE-2025-41450; CVE-2025-41451.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Cold Chain Cyberattacks: FBI and CISA Warn Refrigeration Controllers Are Being Targeted, What France Confirmed and What to Check This Week
Attackers changed refrigeration settings at about 700 French retail sites in October, and US agencies now urge...
Plex2Shell QNAP NAS Exploit: Attackers Compromise Plex Media Server on NAS Devices, the Fixed Version and How to Check Yours
QNAP says attackers have compromised Plex Media Server on some NAS devices using Plex2Shell, a four-flaw chain...
Plasma Storage Cyberattack: Attackers Changed Cold Room Settings at Three French Blood Service Sites Through a Refrigeration Supplier, What Is Confirmed and How to Secure Your Controllers
France's blood service says attackers got in through a refrigeration supplier and pushed cold room settings at...
