Overview
- U.S. and European cyber agencies issued coordinated warnings after attacks on refrigeration controllers that let intruders change setpoints and force continuous heating or defrost cycles, putting food, pharmaceutical and blood cold chains at risk.
- Investigators say the most easily exploited targets are older Danfoss and Copeland/Dixell controllers that were reachable from the internet, ran outdated firmware, or used default and weak passwords so attackers could bypass authentication or inject commands.
- The incidents have produced tangible harms including spoiled supermarket stock, reported fires, and a French blood‑storage alarm that prompted staff to move supplies before any loss occurred.
- Officials told operators to act now by removing controller panels from direct internet exposure, segmenting OT from business networks, applying vendor patches, replacing end‑of‑life devices, and enabling strong authentication and VPNs.
- Open‑source scans show a sharp fall in internet‑exposed controllers consistent with owners disconnecting or hardening devices, investigations and attribution remain unresolved, and the events are driving stricter reporting and product‑security rules in the EU.