ARTICLE ORIGINAL MAG212 CYBER

Cold Chain Under Attack: CISA and FBI Warn After Refrigeration Controller Hacks Hit Supermarkets and Blood Banks

novembre 6, 2026 · El Mostafa Ouchen

MAG212 CYBER | Critical Infrastructure | November 6, 2026

US agencies have joined European authorities in warning that attackers are tampering with the controllers that keep food, medicines and blood products cold. On Thursday, November 5, 2026, CISA, the FBI and the Departments of Health and Human Services, Agriculture et Transportation issued joint guidance on industrial refrigeration and cold-chain monitoring systems, according to Defense One and IT-Connect. The warning follows supermarket attacks in France in October, a second wave across Europe on November 2, an incident at France’s blood service the same night, and an ongoing US investigation into freezer failures at military commissaries. No government has publicly said who is responsible.

Faits clés

Article	Détail
US guidance	November 5, 2026, from CISA, FBI, HHS, USDA and DOT
EU warning	November 4, 2026, from the European Commission, ENISA, Europol and national authorities (per Defense One; text not public in sources reviewed)
Cibles	Temperature and refrigeration controllers in supermarkets and cold-storage warehouses
Effect	Forced heating and defrost cycles; operators unable to see real temperatures
Major incidents	France, night of Oct 11–12; Europe-wide second wave, Nov 2; EFS plasma storage, Nov 2; US commissaries since around late August
Products named	Danfoss AK-SM 800 and AK-SC 355 (by Danfoss); CERT-FR also lists Copeland and Dixell xweb
CVE	None publicly tied to the 2026 attacks
Attribution	None by any government

What the US guidance says

According to IT-Connect’s summary, the guidance covers attacks on industrial refrigeration and cold-chain monitoring systems worldwide, focused on temperature and refrigeration controllers in supermarkets and cold-storage warehouses. Defense One reports that it describes attackers “targeting electronic temperature controls at grocery stores and cold storage facilities.”

Sectors at risk include healthcare, chemicals, food and agriculture, and refrigerated transport, per IT-Connect. The consequences described are spoiled inventory, damaged equipment, fire hazards and potential harm to consumers from products stored at unsafe temperatures. It names no actor, CVE or manufacturer, according to both outlets.

“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said a senior CISA official, Chris Butera, as quoted by Defense One and IT-Connect. Brett Leatherman, the FBI’s cyber branch operations director, described the activity as “putting inventory and equipment at risk,” Defense One reported.

The EU warning and what officials said

Defense One reports that the European Commission, ENISA, Europol and national authorities issued a joint warning on Wednesday, November 4. MAG212 CYBER could not locate the text of that warning, so its specific recommendations are not reported here.

On November 2, EU food and agriculture commissioner Christophe Hansen called the attacks a “deliberate attempt to disrupt our food supply chain,” The Local reported.

Commission spokesman Thomas Regnier said: “These are not isolated incidents, and of course, we have to be collectively resilient and prepared for such cyber incidents.” He declined to name culprits, according to The Local.

The size of the November 2 wave varies by outlet: The Local reported at least nine European countries hit, with Germany, Romania and the UK added on November 3, while Reuters, via ESM Magazine, counted stores in eight. UK NCSC chief Richard Horne said “vulnerable technology had been exploited” and that the UK is “on heightened alert.”

The EFS plasma incident

The French blood service, Établissement français du sang (EFS), said that on Monday, November 2, “temperature and defrosting thresholds were raised to extremely high levels” at plasma cold-storage sites, Euronews reported. “Monitoring and alarm systems quickly detected the anomalies,” EFS said, and “no health consequences have been identified and no blood products were lost.” Plasma was moved or secured. CBS News, citing AP, reported that three plasma cold-storage sites were affected.

Le Canard Enchaîné reported that freezers normally held at −30°C were to be reset as high as 110°C; EFS itself said only “extremely high levels.” France’s national cybersecurity agency, ANSSI, and the Health Ministry are investigating.

The supplier, Coolworld, said in a French-language statement that it is aware of a cybersecurity incident involving remote monitoring software, that the vulnerability “concerne un composant fourni par un prestataire tiers” (concerns a component supplied by a third party), and that only a limited number of its units were affected. It does not name EFS or the third party.

The October supermarket attacks

On the night of Sunday, October 11 to Monday, October 12, attackers remotely triggered the defrost function on refrigeration controllers at French supermarkets, according to The Record and IT-Connect. The Paris prosecutor’s cybercrime unit is investigating, AP reported.

Counts differ by source and scope. Estimates range from about 350 French establishments (Nextgov) to about 700 of France’s 10,000 supermarkets, the figure Finance Minister Roland Lescure gave Parliament on October 13. Chains confirmed smaller numbers, including 300 Intermarché and Netto stores and 80 Coopérative U stores, AP reported. CBS News, citing AP, reported that stores in Belgium and the Netherlands were also hit in mid-October.

BFMTV, via The Record, reported that the controllers were made by Danfoss and that older software versions were targeted. On October 12, Danfoss said most affected systems were older products no longer receiving updates, naming the AK-SM 800 et AK-SC 355, AP reported. In November, Danfoss said its products were involved again and that Dutch systems used default passwords on insecure networks, according to The Hacker News.

France’s CERT-FR issued alert CERTFR-2026-ALE-012 on October 12, last updated October 16. It covers Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb devices, says the campaigns are “probably still ongoing,” and calls exposing management interfaces “contrary to cybersecurity best practices.”

Retailer Ahold Delhaize reported a separate IT network “security issue” in October. The Register reports Ahold did not answer whether it was linked to the refrigeration attacks, and MAG212 CYBER does not treat it as part of this campaign.

The US commissary investigations

Nextgov reported on October 29 that US officials suspect Iran-linked hackers caused freezer malfunctions at about six military commissaries starting around late August 2026. That suspicion comes from two anonymous people familiar with the matter and is unconfirmed; Nextgov’s sources said “it’s possible the assessments may change as investigators learn more.” Cyber Command and Defense Department law-enforcement units are investigating, with French authorities cooperating. IT-Connect names Fort Huachuca, Arizona, among affected sites and says the US guidance does not reference the commissary incidents.

Attribution: what is and isn’t known

No government has publicly attributed any of the incidents, and no authority has confirmed a link between them. Romania’s DNSC director Dan Cimpean said the attacks seem “semi-amateurish” and that DNSC does not suspect a state actor, The Local reported. Belgium’s Centre for Cybersecurity said the actor “may never be determined,” according to The Hacker News. Danfoss, Sabcobel and Kitman each said the November method resembled the French attack, but The Hacker News notes that a shared method does not prove the same actors. No claim of responsibility had appeared as of November 3.

Comment fonctionnent les attaques

What authorities and vendors describe:

Initial access through unpatched or internet-exposed devices. IT-Connect’s summary of the US guidance names authentication bypass, arbitrary code injection and overly weak configuration.
Changed settings that force continuous heating and defrost cycles, and that stop operators from seeing current temperatures.
Older, unsupported Danfoss products and default passwords (Danfoss); a third-party component in remote monitoring software (Coolworld, for the EFS units).

What is unknown: the specific exploit or CVE used, and whether the French, Europe-wide, EFS and US incidents share an actor. In 2025, CISA advisory ICSA-25-140-03 covered three vulnerabilities in Danfoss refrigeration controllers, and Claroty Team82 showed a compromised controller could switch off cooling while still reporting normal temperatures, The Record reported. It is not known whether those flaws were used in 2026.

What defenders should look for

Defrost schedules, temperature thresholds or setpoints that nobody on your team changed. CERT-FR specifically advises checking defrost schedules.
Controllers or panels reachable from the internet, or still using default passwords or end-of-support firmware.
Configuration changes from IP addresses outside your allowlist.
Gaps between controller readings and independent temperature checks (our suggestion, given Team82’s 2025 finding).

How to harden refrigeration controllers

IT-Connect’s summary of the US guidance lists eight measures:

Remove internet exposure. Never expose controllers or their control panels; protect any necessary remote access with a firewall or a patched edge device.
Isolate OT. Place equipment in a dedicated VLAN, separated from business networks. (OT, operational technology, is the equipment that controls physical processes.)
Fix credentials. Change and strengthen default passwords and enable phishing-resistant MFA where possible. IT-Connect doubts MFA is feasible on older gear.
Update and retire. Keep firmware current and plan replacement of end-of-support equipment.
Allowlist. Maintain a list of devices and IP addresses authorized to change configuration.
Back up. Keep current backups, offsite and offline, and test them.
Log. Enable logging; if usable logs are not available, capture network traffic.
Bound setpoints. Define reasonable setpoint ranges and alert when they are exceeded.

CERT-FR adds: on Danfoss devices, set security to Strict, and use firewall IP filtering only as an emergency measure. An illustrative alert policy:

# illustrative only: adapt to your monitoring platform
freezer_setpoint:    alert if outside <min> .. <max> for that unit
defrost_schedule:    alert on any change outside a change window
config_change_source: alert if source IP not in allowlist

How to verify recovery

Reset and reconfigure. CERT-FR advises a factory reset and reconfiguration of compromised devices, and warns that a reset alone is insufficient for end-of-life equipment.
Re-check configuration after restoration, especially defrost schedules and thresholds, against a known-good backup.
Confirm exposure is gone before reconnecting anything, and only restore remote access through a secure VPN.
Test alarms. Alarms caught the change at EFS; confirm yours still fire.

Foire aux questions

Who issued the US cold-chain guidance?

CISA, the FBI and the Departments of Health and Human Services, Agriculture and Transportation, on November 5, 2026.

Which refrigeration controllers are affected?

Danfoss named its older AK-SM 800 and AK-SC 355 products. CERT-FR’s alert covers Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb. The US guidance names no manufacturer.

Was Iran behind the attacks?

No government has said so. Anonymous US officials told Nextgov they suspect Iran-linked hackers in the commissary incidents only, and that assessment may change.

Sources

This article expands the cold-chain lead from the MAG212 CYBER Daily, 6 November 2026. Earlier coverage: The Forgotten Edge, 3 November 2026.

Lire le magazine complet (PDF) →