CISA and FBI warn of refrigeration controller hacks: Danfoss freezers, what to do

CISA, the FBI and three US departments published a joint fact sheet on 5 November 2026 urging owners of industrial refrigeration and cold-chain monitoring systems to act now. Attackers are taking over internet-reachable temperature controllers and forcing them into heating and defrost cycles. In Europe the campaign has already spoiled food in stores across at least a dozen countries since mid-October. The US document names no vendor and lists no CVE, but the European incidents centre on Danfoss controllers, so most of the practical guidance below applies to anyone running those units or similar ones.

Key points

• On 5 November 2026 CISA, the FBI, HHS, USDA and the Department of Transportation jointly warned that attackers are targeting unpatched or internet-exposed refrigeration controllers worldwide.
• Attackers can force units into continuous heating and defrost cycles, and can leave operators unable to see current temperatures (CISA calls this "denial-of-view").
• The first European wave hit hundreds of French supermarkets on the night of 11 October; a second wave followed overnight into 2 November across Belgium, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal, Italy and Luxembourg.
• Danfoss says most affected French units were older models (AK-SM 800 and AK-SC 355) that no longer receive updates; CERT-FR's alert also covers Copeland and Dixell xweb products.
• No group has claimed the attacks, and Belgium's cyber centre says who is behind them may never be established.

What to do

• Who is affected: anyone operating electronic temperature controllers or refrigeration management systems in retail grocery, cold storage, healthcare, food production, chemicals or refrigerated transport. European reporting names the Danfoss AK-SM and AK-SC series and Copeland and Dixell xweb products; CERT-FR's alert covers those.
• Take controllers off the internet or put remote access behind a firewall or edge device that is kept patched (CISA goal reference 3.S).
• Isolate operational technology on its own VLAN, away from business networks.
• Change default passwords, use strong password policies and phishing-resistant multi-factor authentication where the system supports it.
• Patch firmware and retire end-of-life controllers that the vendor no longer updates.
• Restrict who can change settings with device and IP allowlists, and set safe limits for setpoints so downstream equipment alerts when a value leaves the safe range.
• Keep tested offline backups and turn on logging. Where a controller's logs are unavailable, collect network traffic between assets.
• Check whether you are exposed: search for your controllers' management interfaces from outside your network, and ask your refrigeration maintenance contractor how remote access is configured.
• Report incidents to CISA (contact@cisa.dhs.gov, 1-844-729-2472), the FBI's Internet Crime Complaint Center, and HHS (HHSCyber@hhs.gov) for healthcare supply chain disruption.

What happened

The US fact sheet, published on Thursday 5 November, says malicious actors are targeting industrial refrigeration and cold-chain monitoring systems globally. It describes three routes: authentication bypass, arbitrary code injection and weak configurations. The consequences it lists are temperature changes that shorten equipment life, create fire hazards and cause inventory loss, plus indirect harm to consumers who eat food stored unsafely. CISA's acting cybersecurity chief Chris Butera is quoted by TechCrunch as saying "Every organization that depends on refrigeration and monitoring systems should assume it could be a target."

The warning follows an unusual run of incidents in Europe. According to The Hacker News, attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of 11 October. The entry point was the Danfoss controller that runs a store's refrigeration, which maintenance firms often manage remotely. Les Mousquetaires (Intermarché) said its units were put into defrost and heated to as much as 50°C. CERT-FR, France's national response team, published an alert on 12 October about "numerous compromises" affecting the AK-SM and AK-SC series and told operators to disconnect the controllers or filter access to them. The Paris prosecutor's office opened an inquiry.

A second wave came overnight into Monday 2 November. The Hacker News lists affected retailers in Belgium, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal, Italy and Luxembourg, with no chain reporting more than several dozen stores. Examples: Musgrave, which owns SuperValu, said 13 of its 223 Irish stores were hit; Carrefour Belgium counted 15 of more than 700; in Sjöbo, Sweden, ICA fridges and freezers were set to 50°C. Damage varied widely. A freezer at an Estonian Selver store was set to 50°C but warmed only 2-3°C before the problem was fixed in about 10 minutes, with no products damaged, while a Belgian butcher in Hove, whose fridges reached 18°C, estimated about €15,000 of meat ruined.

The Register reports that the attacks have hit thousands of remote-controlled systems at hundreds of grocery stores in France, Belgium, Ireland, Luxembourg and Sweden, and that it found no documented attack on American supermarket refrigeration. TechCrunch adds that the Department of Defense is investigating freezer hacks at military bases, citing Reuters, and that an attempt to raise temperatures in a French blood bank's cold units was stopped before it reached the blood supplies. BleepingComputer adds that the French Blood Establishment (EFS) confirmed on 3 November that settings were altered at three blood storage facilities through a refrigeration equipment provider. The Register's own account differs slightly: it describes Reuters reporting that the Pentagon is treating August freezer malfunctions at bases as a suspected cyberattack. Reports differ, so we treat the military incidents as under investigation, not confirmed.

Background

Refrigeration controllers are a long-standing target because they are internet-reachable by design: contractors monitor and adjust them remotely. The Hacker News notes that in 2022 attackers targeted 16 Russian supermarkets using the AK-SM 800 and hacked 40 Israeli stores, all of which lacked proper firewall or VPN protection. Danfoss patched three flaws in the current AK-SM 800A in 2025: CVE-2025-41450 (authentication bypass, fixed before version 4.2), CVE-2025-41451 (command injection) and CVE-2025-41452 (denial of service), the last two fixed in 4.3.1. The Hacker News stresses these flaws have not been linked to the October attacks. It adds that Claroty has reported thousands of AK-SM 800A management interfaces reachable from the internet.

The numbers

Store counts differ by outlet, which makes totals unreliable. For Intermarché and Netto in France, AFP reported at least 300 stores and Reuters about 150, so the chart below leaves them out and shows only retailers with a single reported figure.

Coopérative U80

Carrefour80

Monoprix30

French stores affected in the October wave, as reported (stores)

	stores
Coopérative U	80
Carrefour	80
Monoprix	30

Source: The Hacker News, 13 October 2026 (Coopérative U, Carrefour, Monoprix; Monoprix is "about 30")

Danfoss told reporters that the affected French units were mostly the AK-SM 800 (end-of-life since May 2021) and the AK-SC 355 (phased out in 2016), with some current AK-SM 800A units running outdated firmware. For the Dutch incidents, a Danfoss spokesperson said the systems were not on a secure network and still used default passwords. Danfoss's security advisories page listed no advisory about the attacks as of 3 November, per The Hacker News.

Losses so far are uneven. Coopérative U's chief executive said the cold chain held in most of its 80 affected stores. Les Mousquetaires' chief expected losses of tens of millions of euros across France, according to the same report.

What it means

For operators, the lesson is plain: a management interface reachable from the internet, with a default password and no vendor updates, is an open door. The fixes are cheap compared with a store's worth of spoiled stock. Retailers that rely on a contractor for remote access should ask how that access is protected, because the controller's owner carries the loss.

For vendors, end-of-life hardware is the weak point. Danfoss says the oldest units get no updates, so the only remedy is replacement or isolation, a message CISA repeats in its call to retire unsupported devices.

For healthcare and food supply chains, the French blood bank incident shows that tampering with temperature controllers is not only a retail problem. HHS is among the co-signers because medicines and blood products also depend on cold storage.

What we don't know yet

• Who is behind it. No group has claimed responsibility, and Belgium's Centre for Cybersecurity says the culprits may never be identified. TechCrunch reports that researchers and reportedly US officials suspect Iran; the US government has not attributed the attacks, so we do not.
• How attackers got in. Officials have not published the technique. Danfoss points to outdated software and default passwords, but CERT-FR had published no indicators of compromise as of 13 October.
• Whether other vendors are affected. CERT-FR's alert covers Copeland and Dixell xweb products, and a Belgian butcher said Copeland equipment was also hit; Copeland gave no clear answer.
• Any US victims. The Register found none documented in supermarkets.
• The full fact sheet. We read the web version; a PDF may contain more.

What to watch next

Watch for a Danfoss security advisory, since none was listed as of 3 November, and for any CVE assigned to the intrusion route. Watch for CERT-FR indicators of compromise, for the Belgian and Paris criminal investigations, and for whether the campaign reaches North American stores, which the US fact sheet's global framing leaves open.

Sources

• CISA fact sheet: US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems
• BleepingComputer: FBI, CISA warn of cyberattacks targeting refrigeration systems
• TechCrunch: US government warns of ongoing cyber threat amid mass hacks of freezers
• The Register: Feds warn grocers about the freezer hacking spree
• The Hacker News: second wave of attacks, 3 November
• The Hacker News: attackers heat French supermarket freezers, October