A coalition of five U.S. federal agencies, including the FBI and CISA, issued an urgent joint advisory on November 5, 2026, warning that cyberattackers are actively targeting industrial refrigeration and cold-chain monitoring systems. The advisory, which includes the USDA, HHS, and DOT, highlights a growing trend of “physical-world consequences” where attackers manipulate temperature controls to spoil food supplies, destroy medical inventory, and create potential fire hazards.
The warning follows a wave of attacks across Europe that has targeted supermarkets in Sweden, Belgium, Luxembourg, Ireland, and Estonia as recently as early November. In these incidents, hackers gained access to refrigeration controllers and triggered “continuous defrost” cycles. This built-in maintenance function, when exploited, can raise temperatures inside cooling units to as high as 50°C (122°F), effectively turning refrigerators into heaters and necessitating the total disposal of perishable goods.
Vulnerabilities in Danfoss and Copeland Systems
The federal advisory identifies specific hardware as the primary targets of this campaign: the Danfoss AK-SM 800A and the Copeland XWEB Pro controllers. These devices are central to the operational technology (OT) of supermarkets, warehouses, and hospitals, managing the precise cooling required for food safety and medical storage.
According to CISA, attackers are exploiting critical vulnerabilities that allow for remote code execution and authentication bypass. Specifically, Danfoss AK-SM 800A controllers are susceptible to CVE-2025-41450 and CVE-2025-41451. These flaws include a “code-of-the-day” authentication bypass that allows attackers to gain root-level access if the devices are connected directly to the internet without proper firewall protections. The Copeland XWEB Pro systems are also being targeted via a command injection vulnerability tracked as CVE-2026-25085.
Escalation to Medical Infrastructure
The scope of the attacks has extended beyond retail environments into critical medical infrastructure. On November 2, 2026, hackers reportedly breached a third-party monitoring tool used by French blood banks (EFS), raising temperatures in storage units to as high as 110°C (230°F), according to data from SecurityScorecard. Such extreme temperature fluctuations render blood products and vaccines unusable and pose a significant risk of electrical fires within the cooling units.
Mitigation and Economic Impact
The economic toll of these disruptions is mounting through the loss of inventory. Beyond the immediate loss of goods, the advisory warns that these attacks can shorten the service life of expensive industrial equipment by forcing components to operate outside of their designed thermal parameters.
To defend against these attacks, federal agencies recommend that operators of cold-chain infrastructure immediately audit their networks for internet-exposed refrigeration controllers. Recommended actions include:
- Ensuring all Danfoss and Copeland controllers are behind a VPN or hardware firewall and are not reachable via the public internet.
- Applying firmware patches specifically addressing CVE-2025-41450 and CVE-2025-41451.
- Disabling remote access features that are not strictly necessary for operations.
- Monitoring for unusual spikes in temperature or unauthorized activation of defrost cycles in refrigeration logs.
The surge in activity highlights a shift toward targeting “low-visibility” OT devices that lack the robust security monitoring typically found in standard IT environments. For further technical details on how these controllers are being manipulated, organizations can refer to the latest updates on the supermarket threat landscape and official CISA alerts.