Refrigeration Controller Hack: CISA and FBI Warn Attackers Are Targeting Cold Chain Systems, What Is Confirmed and What to Check This Week

On Thursday, November 5, 2026, five US agencies warned that attackers are tampering with refrigeration controllers in grocery stores, cold storage sites and refrigerated transport, forcing units into continuous heating and defrost cycles. If your business keeps food, medicine, chemicals or samples cold, and the controller can be reached from the internet, this warning applies to you.

What the CISA and FBI refrigeration warning says

CISA, the FBI, the Department of Health and Human Services (HHS), the US Department of Agriculture (USDA) and the Department of Transportation published a joint fact sheet titled "US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems." The agencies say they are aware of malicious activity against industrial refrigeration and cold chain monitoring systems worldwide. The targets are electronic temperature controllers and commercial refrigeration controllers.

The fact sheet names three ways in:

• Authentication bypass, which means getting past the login.
• Arbitrary code injection, which means running the attacker's own commands on the device.
• Weak configurations, such as default passwords and open remote access.

The agencies list the possible results: shorter equipment life, fire hazards, lost inventory, possible harm to people who eat products stored at unsafe temperatures, and a "denial of view" condition, where staff cannot see the real temperatures. The sectors named are Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems.

What happened in Europe before the warning

France's national computer emergency team, CERT-FR, published alert CERTFR-2026-ALE-012 on Monday, October 12, 2026. It updated the alert on October 13 to add more targeted equipment, and again on October 16 to update its recommendations. CERT-FR says it knows of numerous compromises of remote refrigeration controllers. It names four product lines:

• Copeland xweb
• Danfoss AK-SC series
• Danfoss AK-SM series
• Dixell xweb

Palo Alto Networks' Unit 42 published an analysis on November 6, 2026. It describes a first wave overnight on October 11 to 12 that mainly hit about 700 supermarkets in France. A second wave followed overnight on November 1 to 2. That wave reached at least 10 more European countries and hit roughly 100 to 115 retail locations. Unit 42 says temperatures were raised as high as 50°C (122°F), and in some cases the activity caused fires. French authorities said refrigeration systems at medical facilities were also affected. Unit 42 says there is no evidence that blood products were spoiled.

Confirmed vs claimed: what is known and what is not

How many refrigeration controllers are exposed online

Unit 42 scanned the internet with its Cortex Xpanse tool on November 5 and 6. It found more than 5,000 internet-exposed devices from the manufacturers listed in the CERT-FR alert. In France, its counts were 1,853 for October 1 to 15, 558 for October 16 to 31, and 316 for November 1 to 6. Unit 42 does not say why the numbers fell. It also points out that an exposed device is not necessarily running vulnerable software. Even so, thousands of these controllers can still be reached from anywhere.

Why this matters for a business network

A refrigeration controller is a networked computer with a web login. Your refrigeration contractor usually installs and manages it, often without telling your IT team. Many are set up with a public address or a port forward so that the contractor can check alarms remotely. Nobody puts that device on the list of things to patch. We covered the general problem in Who Is Patching the Software That Runs Your Business?. It is also why default logins keep causing incidents, as in the ForgeRock admin:admin login.

What you can lose here is physical. Think spoiled stock in a restaurant or food distributor, vaccines or samples in a clinic, pharmacy or lab, and equipment damage or fire risk. Your temperature logs may be required for food safety or pharmaceutical compliance, and they become unreliable if attackers can hide the real readings. CERT-FR also advises checking your insurance terms before you cut a contractor's data connection, because some policies depend on that remote monitoring.

What to do this week: refrigeration controller security checklist

If you think a controller has already been tampered with, CERT-FR's steps are: disconnect it from the internet, reboot it or restore factory settings, reconfigure it, harden it, and only then reconnect it through a VPN. CERT-FR warns that a factory reset alone is not enough. The device stays open to reinfection until the exposure and the weakness are fixed.

For help taking building and operational equipment off the open internet, see our security hardening service.

Refrigeration controller hack questions people are asking

Are refrigeration controllers in the US being hacked?

The fact sheet describes the activity as worldwide but names no US victims. The publicly confirmed incidents are in Europe. CISA's guidance is to treat exposed controllers as targets.

Which refrigeration controllers were attacked?

CERT-FR names Copeland xweb, Danfoss AK-SC series, Danfoss AK-SM series and Dixell xweb. The CISA fact sheet names no vendors.

Is there a patch or CVE for the refrigeration attacks?

Neither CISA nor Unit 42 lists a CVE. Both CERT-FR and CISA advise installing current vendor firmware. Ask your vendor or contractor for the latest version for your model.

Does a factory reset fix a hacked controller?

No. CERT-FR says a reset removes the attacker's foothold but leaves the device open to reinfection unless you also remove its internet exposure and harden it.

Who is behind the supermarket fridge attacks?

NoName057(16) and Z-Pentest claimed responsibility. Unit 42 says those claims are unverified.

How do I report a suspected attack?

Contact CISA at contact@cisa.dhs.gov or 1-844-729-2472, or file a report at ic3.gov. Healthcare organisations can also email HHSCyber@hhs.gov.

The bigger lesson

Any device that controls something physical, whether a cooler, a door or a boiler, is part of your network, whoever installed it. If you have not listed it, nobody is patching it. If anyone on the internet can reach its login page, someone will eventually find it.

To get your equipment inventoried, segmented and locked down, see security hardening or request a quote.

Get security alerts by email, plus the free checklist, at /security-alerts.

Sources: CISA: US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems; CERT-FR alert CERTFR-2026-ALE-012; Unit 42: Europe's refrigeration systems attacks.