Overview
- U.S. agencies including CISA and the FBI published a joint advisory on Thursday warning that malicious actors are targeting industrial refrigeration and cold‑chain controllers used by grocers, blood banks and cold storage providers.
- Attackers can remotely change setpoints or force continuous heating and defrost cycles, a tactic that has spoiled supermarket food supplies, caused equipment hazards and nearly compromised blood stores in France.
- Investigations and coordinated European advisories from ENISA, the European Commission and national CSIRTs are ongoing and authorities have not announced a definitive attribution for the campaign.
- Reconnaissance data from internet‑scanning firm Censys shows many operators have already removed vulnerable Danfoss and Copeland/Dixell controllers from the public internet, but large numbers of legacy, unsupported devices remain in service.
- The agencies’ recommended actions are specific and immediate: take controllers off the internet, segment OT from business networks, change default credentials, apply firmware updates or retire end‑of‑support units, and limit remote access to trusted, authenticated channels.