Overview
- U.S. agencies published a joint advisory on Monday, November 9, 2026, saying threat actors are actively targeting industrial refrigeration and cold‑chain controllers and urging immediate action.
- The advisory lists three technical attack paths—authentication bypass, arbitrary code injection, and denial‑of‑service—that let intruders change temperature setpoints or force continuous defrost cycles.
- Reported impacts across Europe have included hundreds of supermarkets with spoiled stock, temperature spikes at three French blood‑plasma sites, and at least one fire or near‑miss linked to altered controller settings.
- Agencies and vendors recommend simple, urgent steps: remove controllers from direct internet exposure, install up‑to‑date firewalls or gateways for remote access, enforce strong authentication, update or replace legacy firmware, segment OT from office networks, and report incidents to CISA, the FBI, or HHS as appropriate.
- Scans from firms such as Censys show internet‑exposed Danfoss and Copeland/Dixell controllers have fallen after guidance was issued but hundreds remain visible, investigators continue cross‑border probes, and researchers have found some abused units acting as spam or proxy nodes.