The United States Cybersecurity and Infrastructure Security Agency and its partners released a fact sheet on securing industrial refrigeration systems after a wave of attacks on fridges and freezers across Europe in recent weeks.
Alongside the FBI and the Departments of Health and Human Services, Agriculture, and Transportation, CISA urged the owners and operators of such devices to use strong authentication, keep systems updated, identify any systems accessible from the internet, remove unnecessary remote access, and secure any remote access that is absolutely necessary.
“The authoring organisations are aware of malicious cyber actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities,” CISA said late last week.
“The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.”
According to CISA, the hackers are exploiting authentication bypass and arbitrary code injection vulnerabilities, as well as weakly configured devices.
The fridge hacking campaign began in October, with as-yet-unidentified hackers causing supermarket fridges and freezers to overheat, spoiling food and even causing fires.
The attacks escalated in early November, however, with hackers targeting Fridges in France used for blood storage.
The initial exploitation path was thought to be linked to Danfoss controllers, but Rapid7’s vice president of threat analytics, Christian Beek, thinks the issue could be more widespread.
“The issue appears to extend beyond Danfoss. France's CERT-FR has explicitly identified Copeland and Dixell XWEB refrigeration controllers alongside Danfoss systems in its warning about numerous compromises,” Beek told Cyber Daily.
“This suggests we are looking at a broader security problem affecting commercial refrigeration infrastructure rather than an isolated issue with one manufacturer.
“As of November 4th, using our own Sonar and services like Shodan/Censys, we identified approximately 2,400 Internet-exposed Copeland/Dixell XWEB systems worldwide, compared with 3,690 in early October. While that represents a 35 per cent reduction, a substantial number of controllers remain directly reachable.”
What makes the situation even more concerning is that there is already a significant body of research outlining vulnerabilities in several controller brands.
“Over 23 vulnerabilities affecting Copeland XWEB Pro controllers, including CVE-2026-21718, a critical authentication bypass vulnerability rated 10.0, and CVE-2026-24663, were discovered in August this year, which could allow unauthenticated remote code execution,” Beek said.
“Researchers have demonstrated how compromising these supervisory systems can allow an attacker to manipulate refrigeration operations and even conceal the actual temperature from operators.
“We cannot conclude that these specific vulnerabilities were exploited in the recent attacks. However, the combination of confirmed compromises, serious known vulnerabilities, and thousands of exposed controllers creates a worrying picture, especially with stories of blood banks in France being hit.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
