Refrigeration controller attacks spoil food in Europe

In refrigeration controller attacks, attackers raised some supermarket refrigeration systems to 50 degrees Celsius, according to The Hacker News. U.S. agencies warn that attackers may use unpatched or internet-accessible refrigeration controllers to change settings and disrupt operations. For operators, I'd make the immediate work finding exposed controllers, restricting remote access and applying updates.

For teams responsible for food, medicine or other temperature-sensitive inventory, I'd regard an unavailable management interface as only part of the problem. The agencies warn of spoiled stock, equipment hazards and possible harm to consumers who buy products stored at unsafe temperatures. Attackers could also interrupt visibility into current temperatures. That leaves operators without the monitoring information these systems are supposed to provide, whether or not the refrigeration settings themselves have changed.

How refrigeration controller attacks disrupt cold storage

The refrigeration controller attacks described in the joint advisory change what refrigeration equipment does, not just whether an operator can reach its interface. An intruder may alter settings to keep a unit heating or repeatedly defrosting. The agencies say those changes can destroy inventory and create equipment hazards, including a possible fire.

The agencies identify authentication bypasses, arbitrary code injection and weak configurations as likely ways into these systems. Their warning covers industrial refrigeration controllers as well as cold-chain monitoring equipment. I'd make that distinction part of an access review: both the equipment controlling the temperature and the systems telling operators what that temperature is belong in the review. Checking one does not account for the other.

• Changed temperatures could shorten equipment service life, damage inventory or expose consumers to products that have been stored unsafely. The agencies also identify a fire hazard as a possible consequence of these changes.
• A denial-of-service could prevent operators from seeing current temperatures.

Reviewing access to the controller while leaving the monitoring system out of scope would leave part of the agencies' warning unaddressed.

“We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk.”

— Brett Leatherman, Cyber Branch Operations Director at the Federal Bureau of Investigation

European incidents reached food and blood-plasma storage

The Hacker News reports that hundreds of supermarkets across Europe were targeted through weaknesses in internet-accessible refrigeration controllers. Attackers raised temperatures or forced cooling equipment into defrost mode. Food spoiled, and the supermarkets suffered financial losses. I'd distinguish those reported outcomes from mere examples of what an attacker might be able to do with access to a controller.

The refrigeration controller attacks also reached refrigeration equipment supporting blood-plasma storage. The French Blood Establishment confirmed that an incident affecting a refrigeration equipment provider caused temperature and defrost settings to be raised to very high levels at three plasma-storage facilities. Here, too, the reported change was to the settings governing the equipment.

I'd include that provider connection in an operator's access review. My recommendation is to review necessary supplier access alongside access managed directly by the organisation. I would not leave a provider-managed controller outside that discussion simply because a supplier manages it. The agencies' advice includes securing remote access that must remain available, so I'd account for those connections in the review as well as the ones an operator can remove.

Danfoss and XWEB exposure fell, but instances remain

Censys measured substantial reductions in exposed Danfoss StoreView and Copeland/Dixell XWEB instances between October 9 and November 5, 2026. Even after those reductions, its figures, reported by The Hacker News, showed hundreds of StoreView instances and thousands of XWEB instances exposed globally. Exposure fell for both products, but neither count fell to zero.

Censys says most of the remaining exposed StoreView instances were in France. I see the drop as useful context, but I'd still expect an operator deciding whether to review their own equipment to account for the instances that remain exposed. I would not treat the global direction of travel as a finding about any particular installation.

I'd use these figures as a reason to check actual reachability, not as reassurance that someone else has already done the work. A declining global count cannot answer the local question: does this organisation still have a controller accessible from the internet?

Reduce refrigeration-controller exposure and tighten access

The agencies recommend finding internet-accessible systems, strengthening authentication, updating equipment, isolating operational technology (OT), removing unnecessary remote access and replacing legacy devices. My suggested order for reviewing refrigeration controllers is to establish exposure first, then work through access and maintenance. I suggest that as a practical ordering for the review, not a sequence prescribed by the advisory. I'd still keep the other tasks on the work plan.

1. Identify which systems are accessible from the internet. Include refrigeration controllers and cold-chain monitoring systems, because the warning covers both. Check exposed systems first, and verify rather than assume that refrigeration equipment is isolated from external access.

2. Remove unnecessary remote access and secure necessary connections, as the agencies recommend. Explicitly identify which connections must remain rather than preserving every existing access path.

3. Change default passwords and strengthen authentication, both of which the agencies recommend. Do not stop at identifying internet exposure: weak configurations and possible authentication bypasses are among the likely routes attackers could use.

4. Isolate the OT devices as well as strengthening authentication; the agencies call for both. Review the refrigeration equipment itself, not just the monitoring interface, which does not cover all the equipment named in the warning.

5. Review updates for the installed equipment. The agencies urge owners and operators to keep systems updated and warn that attackers may exploit weaknesses in unpatched controllers. Update equipment alongside reducing remote exposure; neither task replaces the other.

6. Identify legacy devices that need retirement and replacement. The agencies recommend replacing these devices, not merely changing their passwords or removing an unnecessary remote connection. Keep replacement work on the plan so that immediate access changes do not obscure this separate recommendation.

I'd treat these as separate jobs, even where they concern the same controller. Removing an unnecessary access path does not also change a default password, and changing that password does not update the controller. I would not let completing one action silently close the others in the review.

Exposure counts do not establish which controllers were compromised

The Censys figures count exposed instances, not confirmed successful attacks against every instance counted. They help describe the remaining attack surface. They do not identify which of those systems had their settings changed or which had inventory damaged. I'd distinguish between a count of reachable systems and a record of successful attacks: they answer different questions.

The Hacker News does not identify a single fixed firmware version or a named controller flaw that explains the entire series of attacks. It also says the attackers' identity is unclear. I therefore see no specific universal update target in the reporting that could replace an equipment-by-equipment maintenance review. I'd still expect operators to review the equipment they have in service.

I'd take the same care with the distinction between observed damage and possible harm. Food spoilage and financial losses are reported outcomes. Fires are a hazard the agencies warn could occur; I'd be careful not to read the report as establishing that a fire happened. The blood-plasma incident confirms changed settings, but I'd also note that it does not state that stored plasma was lost. I'd keep those limits in view when describing what these incidents actually caused.

My priority would be to remove unnecessary remote exposure while progressing authentication, updates and replacement work together, without waiting for the attackers' identity to become clear. My take is that the agencies already give operators concrete changes to assess, even without a single flaw or firmware fix covering every system. I'd start by checking which installed controllers and monitoring systems are reachable from the internet, then decide which remote connections genuinely need to remain.