U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses Ravie LakshmananNov 09, 2026Critical Infrastructure / Cyber Attack U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally with an aim to cause service disruptions, fire hazards, and loss of inventory. "The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards," according to a joint advisory. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Health and Human Services (HHS), Department of Agriculture (USDA), and Department of Transportation (DOT), threat actors are likely to exploit authentication bypasses, arbitrary code injection, and weak configurations to gain access to these systems and cause the following effects - Change of temperature, which, in turn, could affect the service life of the system, create a fire hazard, cause inventory loss, or harm consumers who purchase products after unsafe storage. Loss of visibility into current temperatures due to a denial-of-service. In response to the threat, owners and operators are being urged to use strong authentication, keep systems updated, identify any systems that are accessible from the internet, isolate operational technology (OT) devices, change default passwords, retire and replace legacy devices, remove unnecessary remote access, and secure necessary remote access. "Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors," said FBI Cyber Branch Operations Director Brett Leatherman. "We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk." In recent weeks, threat actors have targeted hundreds of supermarkets across Europe by exploiting weaknesses in internet-accessible refrigeration controllers to raise temperatures, in some cases to as high as 50 degrees Celsius (122 degrees Fahrenheit), or force cooling units into defrost mode, spoiling food and resulting in financial losses. Targets of these attacks ranged from major supermarket chains to small grocers and butchers in Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the U.K. Among those targeted was the French Blood Establishment, which confirmed that a cybersecurity incident affecting a refrigeration equipment provider had raised temperature and defrost settings to "extremely high levels" at three facilities used to store blood plasma. It's unclear who is behind the hacking spree. Data from Censys shows that there are still hundreds of Danfoss StoreView instances exposed globally, with most of them located in France, although the number has dropped significantly from 3,004 to 708 between October 9 and November 5, 2026. The Copeland/Dixell XWEB exposure, likewise, has declined from 3,708 to 2,420. The attack surface management platform described the refrigeration attacks across Europe as the latest addition to a list of other recent incidents targeting critical infrastructure, including gas station tank gauges, air raid systems, and water towers. "North America accounts for roughly 38% of global ICS [industrial control systems] exposure," Censys said. "Asia's share grew from 22% in 2024 to 25% in 2026, while Europe's fell from 36.5% to 32%. However, these shifts have not produced an overall decline." "While exposure numbers are high, they're hardly surprising: ICS exposure is a problem that's been reported on and warned about for years. It poses a critical risk to the public as gatekeepers to the world's critical infrastructure." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. critical infrastructure, Cyber Attack, Industrial Control Systems, Operational Technology, Vulnerability China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions AI-Generated Fake Login Pages Are Making Account Takeovers Easier Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Reserve My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk