CISA, FBI Warn of Attacks on Industrial Refrigeration Systems

Executive Summary

On November 5, 2026, a coalition of U.S. federal agencies—CISA, the FBI, HHS, USDA, and DOT—released a joint advisory about ongoing cyberattacks targeting industrial refrigeration and cold chain monitoring systems. The warning highlights that malicious actors are actively exploiting vulnerabilities in internet-accessible electronic temperature controllers, such as the Danfoss AK-SM 800A and Copeland XWEB Pro. These attacks can lead to severe physical consequences, including the loss of perishable goods, equipment damage, and potential fire hazards. The advisory follows a series of disruptive attacks in Europe and urges critical infrastructure operators in sectors like Healthcare, Food and Agriculture, and Transportation to take immediate steps to secure their operational technology (OT) environments.

Threat Overview

The threat involves external attackers identifying and compromising internet-exposed OT controllers used to manage industrial refrigeration systems. These systems are often deployed with default credentials and without proper network segmentation, making them low-hanging fruit for attackers. Recent incidents in France, Belgium, and Sweden have demonstrated the viability of these attacks, where hackers remotely manipulated temperature settings in supermarket freezers, causing tons of food to spoil.

The attack vector is straightforward: scanning the public internet for vulnerable devices and exploiting weak or default credentials to gain access. Once in control, attackers can:

• Modify temperature setpoints, causing products to spoil or thaw.
• Force equipment into continuous defrost or heating cycles, leading to equipment failure and fire risk.
• Disable alarms and monitoring functions to hide their activity.

The advisory also notes that similar malfunctions at U.S. military commissaries are under investigation, indicating the threat is not confined to Europe.

Technical Analysis

The attacks described do not appear to be sophisticated, instead relying on poor security hygiene for internet-connected OT devices. The typical attack chain is:

1. Reconnaissance: Attackers use internet scanning tools like Shodan to find exposed refrigeration controllers. They search for specific product banners or open ports associated with devices like the Danfoss AK-SM 800A. This is a form of T0885 - Web Compromise in the ICS context.
2. Initial Access: Attackers attempt to log in using default or easily guessable credentials. This leverages T0886 - Remote Services.
3. Execution & Impact: Once authenticated, the attacker uses the device's own web interface to manipulate its settings. This constitutes T0829 - Manipulation of Control, as they alter the physical process. By changing temperature settings or forcing defrost cycles, they directly cause a loss of control and physical damage.

The core issue is the exposure of OT systems to the public internet. These devices are not designed to be internet-facing and lack the robust security controls of traditional IT systems. The convergence of IT and OT without proper security architecture creates this significant risk.

Impact Assessment

The impact of these attacks is primarily physical and financial. For sectors like Food and Agriculture, an attack can lead to the spoilage of entire warehouses of food, resulting in millions of dollars in losses and supply chain disruptions. In the Healthcare sector, as seen in the related attack on the French Blood Establishment, compromising cold storage can endanger life-saving medical supplies like blood plasma and vaccines. Beyond inventory loss, forcing equipment to operate outside its design parameters can cause permanent damage and create physical safety hazards like fires.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to identify exposed or compromised systems:

Detection & Response

Detection:

• Asset Inventory: The first step is to know what you have. Conduct a thorough inventory of all OT devices, including refrigeration controllers, and determine their network connectivity.
• Network Monitoring: Implement monitoring at the IT/OT boundary. Any unsolicited inbound traffic from the internet to the OT network is a major red flag. D3FEND's Inbound Traffic Filtering is a foundational control.
• Log Analysis: Collect and analyze logs from controllers, if possible. Look for logins from external IP addresses, multiple failed login attempts, or configuration changes made outside of normal business hours.

Response:

1. If a compromise is detected, immediately disconnect the affected device from the network to prevent further manipulation.
2. Reset the device to a known-good configuration and change all passwords.
3. Preserve logs and system images for forensic investigation.
4. Manually inspect the physical equipment for damage.

Mitigation

The joint advisory provides clear, actionable mitigation steps:

1. Network Isolation: The highest priority is to remove control system devices from the public internet. Place them behind a firewall on a segmented OT network. This is a core principle of D3FEND's Network Isolation.
2. Change Default Passwords: Immediately change all default credentials on controllers and other OT devices. Enforce a strong, unique password policy.
3. Patch Management: Apply security patches from vendors as soon as they are available. This aligns with D3FEND's Software Update.
4. Network Segmentation: Isolate the OT network from the corporate IT network to prevent attackers from pivoting between environments.
5. Secure Remote Access: If remote access is required, use a secure solution like a VPN with multi-factor authentication, rather than exposing the device directly.