Buildings and Comfort

U.S. agencies warn refrigeration operators as France blames Iran for supermarket attacks

Five federal agencies told cold chain operators to take controllers off the internet. On Nov. 9, Paris prosecutors said a unit tied to Iran's Revolutionary Guard was behind the October attack on French supermarkets.

By The Gradient Report Staff

Key points

  • CISA, the FBI, HHS, USDA and the Department of Transportation said Nov. 5 that attackers may exploit unpatched or internet-accessible controllers to force refrigeration units into "continuous heating and defrost cycles." The advisory names no vendor and no incident.
  • Paris prosecutors said Nov. 9 that Iran's Revolutionary Guard was behind the Oct. 12 attack on French supermarkets and asked for international arrest warrants, the Associated Press reported.
  • The Pentagon is treating August freezer failures at at least six U.S. military commissaries as a suspected hack, Reuters reported Oct. 29.
  • Forescout counted 12,976 internet-exposed refrigeration management services on 6,017 IP addresses in 99 countries and territories.

Five U.S. agencies warned on Nov. 5 that attackers are going after industrial refrigeration and cold chain monitoring systems. In a joint advisory, the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services, the Department of Agriculture and the Department of Transportation said they "are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally." The advisory, titled "US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems," is posted on the FBI's Internet Crime Complaint Center site.

The agencies said the actors target "electronic temperature controllers and commercial refrigeration controllers" and "may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers" to change settings remotely and "force units into continuous heating and defrost cycles." They listed three methods: authentication bypass, arbitrary code injection and weak configurations. Possible effects include inventory loss, shorter equipment life, fire hazards and loss of visibility into current temperatures, which the advisory calls a denial-of-view condition.

The advisory names the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors. It does not name a manufacturer, a product, a vulnerability number or an attack.

"Every organization that depends on refrigeration and monitoring systems should assume it could be a target," Chris Butera, CISA's acting executive assistant director for cybersecurity, said, according to Help Net Security.

What the agencies tell operators to do

The advisory lists eight steps:

  • Do not expose control system devices, particularly controller panels, to the internet. Where remote access is needed, put a firewall or other edge device in front of it and keep that device updated.
  • Put operational technology on a dedicated virtual local area network separate from business networks.
  • Change default passwords, use strong passwords and add phishing-resistant multifactor authentication where feasible.
  • Keep firmware up to date and replace end-of-life devices.
  • Allow access only from listed devices and IP addresses.
  • Keep current backups offsite and offline, and test them.
  • Turn on logging and review logs for unexpected activity.
  • Set reasonable setpoint limits for devices downstream of controllers and alert on deviations.
The federal advisory tells operators not to expose refrigeration controller panels to the internet.
The federal advisory tells operators not to expose refrigeration controller panels to the internet.AI-generated illustration

Freezer failures at U.S. bases

The advisory does not mention any U.S. incident. Reuters reported Oct. 29, citing four officials, that the Pentagon is treating freezer malfunctions at U.S. military bases in late August as a suspected hack. Reuters identified at least six commissaries affected. Fort Huachuca in Arizona said in an Aug. 26 Facebook post that its freezer "went into defrost mode where it heated up all the food," Reuters reported.

The Army Criminal Investigation Division's Cyber Field Office is working with French law enforcement, according to Reuters, which said it could not determine who was responsible or which controller brand the bases used.

Nextgov/FCW has reported that U.S. officials suspect Iran-linked hackers were behind the base freezer failures, it said in a Nov. 5 story on the advisory. The officials were not named, and the advisory does not say who is responsible.

France names an Iranian unit

Paris prosecutors said Nov. 9 that Iran's Islamic Revolutionary Guard Corps was behind the Oct. 12 attack, in which attackers took remote control of refrigeration systems at about 700 of France's 10,000 supermarkets, the Associated Press reported. Temperatures reached 50°C (122°F) for about six hours, the AP said.

Paris prosecutor Laure Beccuau opened a judicial investigation into organized cybercrime carried out for a foreign power, Iran, according to the AP. Prosecutors requested international arrest warrants for "the leader of Shahid Kaveh, an offensive cyber unit affiliated with the Revolutionary Guards, and his two deputies," Al Jazeera reported. Investigators found the attackers used Farsi and IP addresses tied to devices in Iran, the AP said.

Foreign Minister Jean-Noël Barrot summoned Iran's ambassador and called it "an attack of unprecedented scale and aggressiveness," the AP reported. France will seek sanctions at the European level, according to Al Jazeera. Neither outlet reported a response from Iran.

Prosecutors' statements as reported cover the Oct. 12 French attack. They do not say who was behind the second wave of attacks on stores in Belgium, Luxembourg, Sweden, Ireland, Estonia and other countries overnight into Nov. 2.

In the United Kingdom, three members of the Association of Independent Meat Suppliers were hit through Copeland XWEB supervisory controllers, The Record reported Nov. 3. Copeland told The Record that certain XWEB monitoring products are affected by the reported vulnerability, that it is "continuing to assess the circumstances" and that it "re-communicated the recommended patching and security protocols" to customers.

How many systems are online

Forescout's Vedere Labs said in an Oct. 22 report that it found "12,976 internet-exposed service observations across 10 product groups," on 6,017 public IP addresses in 99 countries and territories, using the Shodan search engine. Copeland and Dixell XWEB accounted for 7,075 and Danfoss StoreView for 4,697. The report does not give a count for the United States.

Internet-exposed refrigeration management servicesService observations found by Forescout using Shodan, by product group (12,976 total)Internet-exposed refrigeration management servicesService observations found by Forescout using Shodan, by product group (12,976 total)Copeland/Dixell XWEBCopeland/Dixell XWEB: 7,0757,075Danfoss StoreViewDanfoss StoreView: 4,6974,697Copeland Site SupervisorCopeland Site Supervisor: 551551Carel pCOWebCarel pCOWeb: 513513Six other product groupsSix other product groups: 140140The 12,976 observations came from 6,017 public IP addresses in 99 countries and territories.Forescout counts service observations, not individual controllers. No collection date was given.Source: Forescout Vedere Labs, "Cold Chain, Open Control," Oct. 22, 2026. Chart: The Gradient Report.

"Since January 2026, our tracking of hacktivist groups identified over 20 claimed attacks against refrigeration systems," Forescout wrote. It named the most active groups as Z-Pentest Alliance and NoName057(16), which it described as pro-Russian. Forescout did not say the claims were verified.

Glasgow-based Lupovis detected "over 276 attempts coming from 91 different threat actors" against Danfoss AK-SM refrigeration controllers starting Oct. 20, Cooling Post reported Nov. 8. The activity peaked Oct. 26, and "most adversaries attempted to authenticate using the publicly documented factory-default username and password credentials," Cooling Post reported. VRT NWS put the count at 256 attempts on simulated Danfoss systems from Oct. 20 to Oct. 30.

Sources

Continue Reading