Five US Agencies Warn on Exposed Refrigeration Controllers

Five United States agencies published a joint fact sheet on 5 November 2026 telling owners of industrial refrigeration and cold chain monitoring systems to get their controllers off the public internet. The Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation wrote that they "are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally". The document names no vulnerability, no threat actor and no American victim.

What it does name is the equipment. The fact sheet identifies electronic temperature controllers and commercial refrigeration controllers used in retail grocery stores and cold storage facilities, and lists three routes in: authentication bypass, arbitrary code injection and weak configurations. Attackers who get through can alter settings remotely and force units into continuous heating and defrost cycles. The listed effects are a shortened service life, a fire hazard, loss of inventory, indirect harm to consumers who eat products stored unsafely, and what the document calls a denial-of-view condition, in which operators lose sight of the temperature.

The European incidents behind the warning

The sequence in Europe is what gives the advisory its urgency. Infosecurity Magazine reported on 11 October 2026 that several French and other European supermarket chains had to destroy food stock after systems administered by the refrigeration supplier Danfoss were compromised, with attackers programming units to reach temperatures as high as 50C. A second round on 1 November reached supermarkets in at least nine European countries. Most recently, an attack on the refrigeration equipment provider Coolworld sent cold storage rooms at France's National Blood Service to 110C.

None of it has been pinned on anyone. No agency or vendor has attributed the activity to a named threat actor, and the authoring organisations do not say whether any system inside the United States has been reached, only that owners should assume they could be.

One number on whether the exposure is closing

Censys published scan data on 5 November 2026 showing a 53 per cent fall in internet-exposed refrigeration controllers across the Danfoss StoreView and Copeland/Dixell XWEB product families involved in the supermarket incidents. Censys said the drop is consistent with action by the suppliers or with owners disconnecting the devices themselves. That is the only quantified sign of progress attached to this episode, and it comes from a commercial scanning company rather than from any of the five agencies.

Brett Leatherman, operations director of the FBI's Cyber Branch, said the bureau is seeing these systems targeted across critical infrastructure sectors globally. The fact sheet covers four of them: healthcare and public health, chemical, food and agriculture, and transportation systems, including refrigerated transport.

Mitigations written for devices that should never have been reachable

The mitigations map to the Cross-Sector Cybersecurity Performance Goals that CISA developed with the National Institute of Standards and Technology: keep controller panels off the internet, put operational technology on a dedicated virtual local area network, change default passwords, add phishing-resistant multifactor authentication, retire end-of-life devices, maintain IP allowlists, hold offline backups and review logs.

One item is specific to this class of equipment and worth reading twice: define reasonable setpoint limits for devices operating downstream of controllers, and alert on deviations. That is a control on the physical consequence rather than on the network path, and it is the kind of advice that only appears once attackers have shown they can turn a freezer into an oven.

The honest reading is that this is a fact sheet rather than a directive, and the difference matters. When CISA has firm evidence of exploitation against a specific product it adds a CVE to its Known Exploited Vulnerabilities catalogue and sets a federal deadline, as it did with the Ivanti Connect Secure chain on 30 October 2026 and with the WordPress Core flaw CVE-2026-119977 on 2 November 2026. This document does neither. It points at a category of device, sitting behind grocery aisles and hospital loading bays, and asks the owners to go and find them.