Five US Agencies Warn About Attacks on Refrigeration Controllers. The Fact Sheet Names No Vendor, No CVE and No Actor, So Check Whether Yours Is Reachable From the Internet
If you run refrigeration for a grocery store, a warehouse, a pharmacy or a cold-storage site, find out today whether your controller's web page can be reached from the internet, and if it can, take it off. That is the first item in a joint fact sheet that CISA, the FBI, HHS, USDA and the Department of Transportation published with an "as of" date of November 5, 2026.
What the fact sheet says
The agencies say they are "aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally." They describe actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities, and say the actors "may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles."
The routes they list are authentication bypass, arbitrary code injection and weak configurations. The effects they list are temperature changes (shorter equipment life, fire hazard, lost inventory, and harm to consumers who eat product stored unsafely) and loss of visibility into current temperatures.
What it does not say
We read the fact sheet itself. Several things you may have seen in news coverage are not in it.
- It names no manufacturer or product. Reports tying it to Danfoss, Copeland or Dixell equipment are the outlets' own connection, not the agencies' text.
- It lists no CVE numbers.
- It names no threat actor and attributes the activity to no country.
- It publishes no IP addresses, domains or file hashes, so there is nothing for us to add to the blocklist from it.
- Its wording is "aware of malicious activity" and "may exploit." It does not state how many sites were affected or confirm a specific incident. Some outlets wrote that the agencies confirmed active exploitation. That is stronger than the document.
What to do
The agencies' list, in their order:
- Remove controllers and control panels from the public internet. If remote access is needed, put it behind a firewall or edge device that is kept up to date.
- Put operational technology on its own VLAN, separate from the business network.
- Change default passwords, use strong ones, and use phishing-resistant multifactor authentication where possible.
- Keep firmware current, and retire and replace devices the manufacturer no longer supports.
- Allowlist the devices and IP addresses that are permitted to change settings.
- Keep offsite, offline backups and test them.
- Turn on logging and review it. Where devices keep no usable logs, collect the network traffic between them.
- Set reasonable limits on temperature setpoints for the equipment downstream of the controllers, and alert when readings leave them.
The last item is the one most sites skip. A controller that is told to heat will do it quietly, so an alert on temperature out of range is your detection even if everything else fails.
To report suspicious activity: CISA's 24/7 operations center at [email protected] or 1-844-729-2472, the FBI's IC3 or a local field office, and for healthcare, [email protected] or 202-619-7800.
How this fits what we published November 2
On November 2 we covered the French cyber agency's report on supermarket freezers in Europe, where controller management pages were exposed to the internet (Danfoss XWeb). This fact sheet is a different document from a different set of agencies, published three days later. It does not cite the European incident, and we are not claiming it is about the same events.
Sources
CISA, FBI, HHS, USDA and DOT, "US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems," TLP:CLEAR, as of November 5, 2026 (ic3.gov/CSA/2026/261105.pdf). Our November 2 post on the French agency report.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.