Title: US Government Agencies Warn: Internet-Exposed Refrigeration Controllers Are Being Abused to Melt Inventory and Create Fire Hazards
Summary: Concerned agencies behind a joint fact sheet published November 5, 2026 — CISA, the FBI, HHS, the USDA and the Department of Transportation — say malicious cyber actors are targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities globally. Exploiting authentication bypasses, arbitrary code injection, or weak configurations on unpatched or internet-accessible controllers, CISA warns that a compromise can drive units into continuous heating and defrost cycles remotely, with inventory loss and equipment hazards among the expected consequences; exposed units are those left unpatched or reachable from the internet: changed temperatures can shorten system service life, create fire hazards, spoil stock, and indirectly harm consumers who buy products stored unsafely, while a denial-of-view can leave operators blind to current temperatures. The fact sheet lands amid a real spate: in recent weeks attackers hit hundreds of supermarkets across Europe by abusing internet-accessible refrigeration controllers — per The Hacker News, raising temperatures in some cases to 50 degrees Celsius (122 Fahrenheit) or forcing defrost mode, hitting grocers from Belgium and France to Sweden and the U.K., and even the French Blood Establishment, which said a refrigeration equipment provider incident had pushed temperature and defrost settings to “extremely high levels” at three plasma storage sites. Censys data cited in the same reporting shows exposed Danfoss StoreView instances fell from 3,004 to 708 and Copeland/Dixell XWEB from 3,708 to 2,420 between October 9 and November 5, 2026 — but hundreds remain exposed. Owners and operators should pull controller panels off the public internet, isolate OT on dedicated VLANs, change default passwords, add phishing-resistant MFA where feasible, patch firmware and retire end-of-life devices, restrict changes to allowlisted IPs, keep offline backups with tested restores, log and review activity, and enforce reasonable setpoint limits with alerting for deviations.
References: