U.S. government agencies have warned that bad actors are actively targeting industrial refrigeration and cold chain monitoring systems globally in an effort to cause service interruptions, fire risks and inventory losses.
“Actors could exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely change settings and force units into continuous heating and defrosting cycles, which can lead to widespread inventory losses and equipment risks,” according to a joint advisory.
According to the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Health and Human Services (HHS), Department of Agriculture (USDA), and Department of Transportation (DOT), malicious actors are likely to exploit authentication bypasses, arbitrary code injection, and weak configurations to gain access to these systems and cause the following effects:
- A change in temperature which, in turn, could affect the life of the system, create a fire hazard, lead to loss of inventory or harm consumers who purchase products after unsafe storage.
- Loss of visibility on current temperatures due to denial of service.
In response to this threat, owners and operators are advised to use strong authentication, keep systems up to date, identify all systems accessible from the Internet, isolate operational technology (OT) devices, change default passwords, remove and replace existing devices, remove unnecessary remote access, and secure necessary remote access.
“Industrial refrigeration and cold chain monitoring systems protect food, drugs and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” said Brett Leatherman, director of operations for the FBI Cyber Branch.
“We are seeing these systems being targeted in critical infrastructure sectors globally, putting inventory and equipment at risk.”
In recent weeks, malicious actors have targeted hundreds of supermarkets across Europe by exploiting weaknesses in internet-accessible refrigeration controllers to raise the temperature, in some cases up to 50 degrees Celsius (122 degrees Fahrenheit), or force refrigeration units into defrost mode, thereby spoiling food and leading to financial losses.
The targets of these attacks ranged from large supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden and the United Kingdom.
Among those targeted was the French Blood Establishment, which confirmed that a cybersecurity incident affecting a refrigeration equipment supplier had raised temperature and defrost settings to “extremely high levels” at three blood plasma storage facilities. We don’t know who is behind this wave of hacking.
Censys data shows that there are still hundreds of Danfoss StoreView instances exposed worldwide, most of them located in France, although their number has decreased significantly from 3,004 to 708 between October 9 and November 5, 2026. The Copeland/Dixell XWEB exposure, similarly, decreased from 3,708 to 2,420.
The attack surface management platform described the refrigeration attacks across Europe as the latest addition to a list of other recent incidents targeting critical infrastructure, including gas station tank gauges, air raid systems and water towers.
“North America accounts for approximately 38% of global ICS (industrial control systems) exposure,” Censys said. “Asia’s share increased from 22% in 2024 to 25% in 2026, while Europe’s share fell from 36.5% to 32%. However, these changes did not lead to an overall decline.”
“Although the exposure figures are high, they are hardly surprising: exposure to ICS has been a problem reported and warned about for years. It represents a critical risk to the public as stewards of the world’s critical infrastructure.”
Gn bussni
