Overview
- A wave of attacks that began in October and continued into early November hit commercial refrigeration systems across Europe and affected U.S. military commissaries, spoiling supermarket food and briefly spiking temperatures in three French blood‑bank cold rooms.
- U.S. agencies issued a joint advisory on Thursday calling for immediate action after finding malicious actors may force units into continuous heating or defrost cycles and create 'denial‑of‑view' conditions.
- Investigators say the attackers exploited internet‑accessible, unpatched or end‑of‑life controllers that used weak or default credentials and predictable configurations, using techniques such as authentication bypass and arbitrary code injection to change temperature settings.
- Operators and vendors have moved to remove devices from the public internet, isolate OT networks, apply patches, retire unsupported equipment and enable stronger authentication, with Censys reporting about a 53% drop in exposed controllers for the affected product families.
- Criminal and forensic investigations are ongoing in Europe and the U.S., no public attribution has been confirmed, and regulators point to tighter product‑security and reporting rules under EU measures like NIS2 and the Cyber Resilience Act as likely next steps.