Security Operations

Follow-up: US agencies issue hardening advice after fridge attacks

CISA, FBI and three US agencies publish cold-chain controller hardening advice after Europe’s fridge attacks. What UK defenders should do now.

Shield graphic with the headline US issues cold-chain controller hardening advice

Five US federal agencies have published joint guidance on locking down the industrial refrigeration and cold-chain controllers behind Europe’s wave of fridge sabotage. It gives defenders a formal multi-agency checklist, and UK operators of supermarkets, pharmacies, blood stores and refrigerated logistics should treat it as their checklist too.

What happened

On 5 November 2026 CISA, the FBI, the US Department of Agriculture, the Department of Transportation and Health and Human Services released a joint fact sheet titled US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems. The agencies say they are aware of malicious activity aimed at these systems worldwide, and they ask owners and operators to act immediately.

This is a follow-up to our earlier coverage of the attacks, and the new element is the advice itself. Since mid-October, unidentified attackers have remotely altered temperature settings at hundreds of European supermarkets, first in France and then, at the start of November, across several more countries including Belgium, Ireland, Luxembourg and Sweden, with units pushed as high as 50°C. The French Blood Establishment (EFS) has since reported temperature spikes in cold rooms at three of its blood banks after a refrigeration supplier was hit.

CISA’s acting executive assistant director for cybersecurity, Chris Butera, said organisations relying on these systems “should assume it could be a target”. The FBI’s Cyber Branch operations director, Brett Leatherman, said the bureau is seeing the systems targeted across several infrastructure sectors. Nobody has claimed the attacks, and no agency has attributed them.

The technical picture

The guidance centres on the temperature and refrigeration controllers used across grocery retail and cold storage sites. These are often web-managed boxes that let a contractor or head office adjust setpoints, manage defrost cycles and pull temperature logs remotely. The agencies list three broad routes in: authentication bypass, arbitrary code injection and weak configuration, typically on controllers that are unpatched or reachable directly from the internet.

Once inside, an attacker can force units into continuous heating or defrost. The listed consequences include lost stock, a shorter working life for the plant, fire risk and harm to consumers if food or medicine is used after unsafe storage. The agencies also flag a “denial-of-view” condition, where staff can no longer see current temperatures. For defenders that is arguably the nastiest outcome, because the monitoring meant to raise the alarm becomes the thing the attacker controls.

Exposure is already falling. According to Censys data reported by Infosecurity Magazine, the number of internet-exposed Danfoss StoreView and Copeland/Dixell XWEB controllers, the product families linked to the supermarket incidents, has dropped by 53%. Censys said the fall was consistent with provider action or owners disconnecting devices. Halving the exposed population this quickly is real progress, but the rest are still out there.

Checklist of six hardening steps for refrigeration and cold-chain controllers from the US joint fact sheet

Why it matters for UK organisations

None of the reporting so far names a UK victim, but the UK runs the same equipment in the same kinds of places: supermarket estates, distribution centres, hospital pharmacies, vaccine and blood storage, and refrigerated haulage. The attacks have already reached Ireland, so the threat has crossed into the British Isles, and some of the retail groups affected operate internationally.

The fact sheet points readers to the NCSC and partners’ Secure Connectivity Principles for OT, so UK defenders have a domestic reference that sits alongside the US guidance. For organisations within scope of the NIS Regulations, and of the Cyber Security and Resilience Bill once it takes effect, refrigeration controllers in health and logistics settings are operational technology and belong in the asset register and the incident plan. They should not be left as a facilities problem that never reaches the SOC.

The ownership gap is the real UK risk. In many estates these controllers are installed and remotely supported by a refrigeration contractor, connected through a 4G router or a port forward that IT never approved. They rarely appear in vulnerability scans or feed the SIEM, and the contract may not say who patches firmware.

Expert view

When we test retail and healthcare estates, building management and refrigeration kit is one of the most reliable footholds we find. The pattern is familiar: a web console with a default or shared password, exposed so an engineer can dial in at 3am, running firmware years out of date. Nothing in the US guidance is novel, and that is the point. These attacks do not need zero-days when the front door is unlocked.

The most useful item for a security operations team is the last one: set sensible setpoint limits downstream of the controller and alert on deviations. That is a physical-process control as much as a cyber one, and it gives you a detection that still works if the controller itself is compromised and lying to its own dashboard. In my experience, the organisations that cope best with OT incidents are the ones whose facilities and security teams have already agreed who gets called when a sensor goes out of range.

I would also read the denial-of-view warning as a prompt to check independent monitoring. If your only record of a cold room’s temperature passes through the same internet-facing controller, you have a single point of failure for both safety and evidence.

What to do now

  1. Find every controller. Search your external attack surface and your contractors’ remote access arrangements for refrigeration, building management and temperature logging consoles. Anything reachable from the internet should come off it today (Cyber Essentials: firewalls).
  2. Put remote access behind a gateway. If a supplier genuinely needs access, route it through a patched VPN or edge device with phishing-resistant MFA and per-engineer accounts, and remove port forwards and unmanaged cellular routers.
  3. Segment. Place OT devices on a dedicated VLAN away from corporate and guest networks, and allowlist the specific hosts and IP addresses permitted to change settings (Cyber Essentials: secure configuration, user access control).
  4. Kill default credentials and patch. Change default and shared passwords, update firmware, and set a retirement date for controllers the vendor no longer supports (Cyber Essentials: secure configuration, security update management).
  5. Detect at the process level. Define safe setpoint ranges, alert on deviations, and add independent temperature sensors where stock is high-value or clinical. Where devices cannot produce useful logs, capture network traffic to and from them.
  6. Bring it into incident response. Add cold-chain compromise to your playbooks, with named facilities contacts, contractor escalation routes, offline configuration backups and a manual fallback for temperature checks.
  7. Talk to suppliers. Ask your refrigeration maintainers how they access your sites, who holds the credentials, and how quickly they can push firmware updates.

Bottom line

The US fact sheet turns a run of alarming European incidents into a short, practical to-do list, and it applies as much in Leeds as it does in Louisiana. The 53% fall in exposed controllers shows that owners can move quickly once they know the risk. UK organisations with anything temperature-sensitive should find their controllers, take them off the internet, and make sure someone in the SOC hears about it when a freezer starts warming up.

Sources

Related Posts