U.S. Warns of ongoing cyber threat to industrial refrigeration systems. Key points * CISA, the FBI, HHS, USDA and DOT said attackers are targeting internet-accessible refrigeration controllers across food, health-care, chemical and transportation operations. [[1]] * The warning follows at least three reported waves of incidents, including attacks affecting more than 100 European stores, French supermarkets and suspected malfunctions at U.S. military commissaries. [[3]] [[4]] * Publicly documented affected or exposed platforms include Danfoss AK-SM 800A and Copeland XWEB Pro controllers, though researchers have not tied their disclosed vulnerabilities to every reported attack. [[7]] [[8]] * The agencies urged operators to remove unnecessary internet exposure, isolate operational technology, strengthen authentication, apply patches and replace unsupported equipment. [[1]] [[2]] U.S. cybersecurity and sector agencies warned Thursday that attackers are targeting industrial refrigeration and cold-chain monitoring systems, raising the prospect of spoiled food, damaged medical supplies and physical hazards at facilities that depend on connected cooling equipment. [[1]] [[3]] The fact sheet from the Cybersecurity and Infrastructure Security Agency, FBI, Department of Health and Human Services, Department of Agriculture and Department of Transportation does not identify a perpetrator, a specific campaign or a confirmed worldwide victim count. It says malicious actors are targeting electronic temperature controllers and commercial refrigeration controllers in grocery stores and cold-storage facilities. [[1]] [[2]] The warning follows several waves of incidents. The agencies said refrigeration systems are widely used in the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors for remote temperature monitoring, continuous logging, defrost-cycle management and energy optimization. A successful intrusion could alter temperatures, force equipment into continuous heating or defrost cycles, create fire hazards, damage inventory or shorten equipment life. [[1]] [[2]] Independent reporting has identified at least three reported waves of suspected attacks in recent months. A French incident in October affected supermarkets and caused losses described by Reuters as reaching tens of millions of euros. A second wave on Nov. 1 and 2 affected more than 100 stores across several European countries. A separate incident involved cold-storage units at three sites operated for France's national blood service. [[3]] [[4]] [[5]] [[6]] The French blood service said its alarms detected abnormal temperature changes before blood products were compromised. That incident nevertheless showed how a breach involving an equipment provider or refrigeration controller can reach into a health-care supply chain without taking down a hospital's core information systems. [[6]] Danfoss and Copeland platforms are documented in the research. Public reporting has linked some affected European systems to refrigeration controllers made by Danish manufacturer Danfoss. Claroty's Team82 researchers found three vulnerabilities in the Danfoss AK-SM 800A platform, including a hidden authentication-bypass mechanism, a command-injection flaw that could enable remote code execution after authentication, and a weakness that could permit denial of service. Danfoss addressed the issues in firmware updates. [[7]] Claroty separately reported 23 vulnerabilities in Copeland's XWEB Pro platform, 21 of them rated high severity by the researchers. The findings included paths that could allow an unauthenticated attacker to bypass security controls and ultimately obtain root-level remote code execution. Copeland released firmware version 1.13 to address the findings. [[8]] Neither the U.S. fact sheet nor the vendor research establishes that these specific vulnerabilities were used in each recent attack. Claroty said it found 2,765 internet-facing Danfoss AK-SM 800A and Copeland XWEB controllers before the latest incidents, but exposed devices are not the same as confirmed victims. [[9]] The government fact sheet describes the broader attack surface as unpatched or internet-accessible controllers with authentication bypasses, arbitrary code injection or weak configurations. Successful exploitation could change temperatures or create a denial-of-view condition in which operators cannot see the true state of a unit. [[1]] [[2]] Military systems remain under investigation. The Defense Department is investigating unusual heating and defrost events involving freezer units at several U.S. military commissaries in August. Reuters reported that Pentagon investigators are treating the malfunctions as suspected cyberattacks, but available public reporting has not confirmed that the systems were compromised by the same activity described in the new fact sheet. [[3]] [[4]] The reported military incidents concern commissary refrigeration equipment. There is no public confirmation that classified systems or weapon-related military systems were affected. That distinction matters because the government warning covers industrial refrigeration broadly, while the military cases remain under investigation. [[3]] [[4]] Federal guidance focuses on exposure and equipment lifecycle. The agencies urged operators to remove control systems from the public internet, isolate operational technology from business networks, secure necessary remote access and replace default credentials with strong authentication. They also recommended allowlisting authorized devices and IP addresses, maintaining offline backups, enabling logging and network monitoring, and setting safe limits and alerts for temperature changes. [[1]] [[2]] The fact sheet calls for firmware updates and a lifecycle process to identify and replace equipment that has reached end of life and is no longer supported by its manufacturer. That recommendation is particularly relevant to operators that rely on third-party refrigeration contractors or remote maintenance providers, because the exposed controller may sit outside an organization's conventional IT inventory. [[1]] [[2]] CISA said it is tracking the activity with government, industry and international partners. The FBI urged operators to report suspicious activity. Neither agency publicly attributed the attacks to Iran or another government; reports that Iran may be responsible remain unconfirmed. [[3]] [[4]] At the intersection of AI, tech, and markets. The stories that matter, in one email. Free - unsubscribe anytime.

AI reproduces known freezer-control flaws in 28-minute lab test. European grocers reported refrigeration disruptions Nov. 2, but no evidence ties AI or the tested Danfoss flaws to those store incidents. Nov 2, 2026, 10:58 PM PST An AI-assisted lab test reproduced known flaws in a refrigeration controller in about 28 minutes, as European grocers reported disruptions with no evidence tying the experiment to the store incidents. On Nov. 2, Carrefour told The Associated Press that refrigeration problems affected 15 of its more than 700 stores in Belgium. Musgrave said systems were affected at 13 SuperValu stores in Ireland. An ICA store in Sjöbo, Sweden, said its fridges and freezers had been hacked and set to 50 degrees Celsius (122 degrees Fahrenheit). The incidents forced some stores to remove or discard chilled and frozen products. The reports continued a series of European grocers' refrigeration incidents. France's National Agency for the Security of Information Systems (ANSSI) said in an alert published Oct. 12 and updated Oct. 16 that it knew of numerous compromises involving Danfoss AK-SM and AK-SC, Copeland XWEB and Dixell XWEB controllers. The alert did not identify how the devices were accessed. Remote access lets technicians check refrigeration equipment off-site, reducing visits to individual locations, Claroty said in its controller research. ANSSI advised operators to keep management interfaces off the public internet, use a protected network or secure VPN for remote access, update firmware and replace default passwords. It warned that exposed equipment without security support faced a very high risk of compromise. Separately, Claroty's Team82 used Anthropic's Claude Sonnet 4.6 through the Cursor code editor to test flaws it had previously identified in the Danfoss AK-SM 800A controller. Researchers chained two vulnerabilities to demonstrate root-level command execution on a lab device. Claroty said the test took about 28 minutes and cost about $6 in AI usage. Danfoss addressed the three identified vulnerabilities in firmware version R4.3.1. The test started with public vulnerability information, firmware and analysis tools. After the AI agent misread an authentication flaw, a researcher redirected it and checked its results. Amir Zaltzman, a vulnerability researcher at Claroty's Team82, said, "This was not an autonomous vulnerability discovery from scratch." Claroty said the precise attack route in France remained unconfirmed. Reuters reported that no one had claimed responsibility for the Nov. 2 incidents and that it could not establish whether they were linked to the French incidents. The lab test does not show that AI or the tested Danfoss flaws were used in the store disruptions.