On November 5, five US agencies (CISA, the FBI, HHS, USDA and the Department of Transportation) published a joint advisory warning that attackers around the world are going after the temperature controllers in grocery stores and cold storage, forcing units into continuous heating and defrost cycles. It lands after nearly a month in which supermarkets in at least nine European countries pulled chilled and frozen stock because someone had set their freezers to 50°C. Nobody has been named, and the Kremlin denied involvement anyway. For engineers, the instructive part is how ordinary the failure looks: a small embedded web server, a setpoint field, and an internet connection nobody was watching.
What the advisory says, and what it leaves blank
The document is short and deliberately generic. It covers electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage, and lists three ways in: authentication bypass, arbitrary code injection and weak configurations, all aimed at devices that are unpatched or reachable from the internet. The consequences it lists go beyond spoiled stock: shortened equipment life, a fire hazard, and what OT people call a denial-of-view condition, where operators lose sight of the real temperature. That last one deserves more attention than it gets. A freezer at 50°C is a loss; a freezer at 50°C whose dashboard still reads normal is a food-safety incident. Four sectors are named: healthcare and public health, chemical, food and agriculture, and transportation.
What the advisory omits is just as telling. It names no vendors, no products, no CVEs, no incident counts and no attacker. CISA's Chris Butera told Infosecurity Magazine that any organization relying on these systems "should assume it could be a target," which is advice and an admission in the same breath.
A month in Europe's freezer aisles
The reported timeline starts on October 11, when several supermarket chains in France and elsewhere in Europe destroyed food after attackers got into systems run by refrigeration vendor Danfoss; earlier coverage names both Danfoss and Copeland. Temperatures were reportedly set as high as 50°C (122°F). For scale, USDA guidance is to keep freezers at 0°F or lower and refrigerators at 40°F or lower. The reported setting sits 122 degrees Fahrenheit above the freezer line, a symmetry nobody asked for.
The second wave came around November 1 (Infosecurity's date; scanning firm Censys puts it at November 2) and reached at least nine countries: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. Ireland's SuperValu removed chilled and frozen products from 13 stores as a precaution. An ICA store in Sweden reportedly posted that its fridges and freezers had been hacked and set to 50°C. IKEA's outlet in Mons, Belgium, saw freezer temperatures climb. UK food suppliers were also hit, and the head of the UK's NCSC said vulnerable technology had been exploited in a couple of British cases.
Infosecurity also reports that cold storage rooms at France's national blood service (EFS), managed through a Coolworld system, were driven to 110°C; we could not confirm that figure against a primary source. On losses, AFP reports that retailers discarded hundreds of millions of dollars' worth of food, without a breakdown.
Attribution is the part nobody can settle yet
The EU's agriculture commissioner called the attacks a "deliberate attempt" to disrupt the food supply chain, and European governments have recently warned of increased Russian sabotage. On November 5, Kremlin spokesman Dmitry Peskov dismissed the allegations as "absurd statements" offered without proof. No group has claimed responsibility, and neither the US advisory nor the reporting cited here attributes the campaign to anyone. That is where the record stands, and it may stay there for a while.
Why a fridge is a soft target
A supermarket refrigeration controller is built for a facilities technician, not a security team. It holds setpoints, runs defrost cycles, raises alarms and exposes all of it through a web interface that someone can reach from a service van. Censys tracks two such product lines, Danfoss StoreView and Copeland/Dixell XWEB, and found that internet-exposed instances fell 53% after the incidents, which it said is consistent with providers or owners disconnecting them. That is the right first move and a quietly damning one: a large share of the fleet came off the public internet within days, which says something about why it was there. How the attackers actually got in has not been publicly established.
The mitigation list could have been written in 2012: take controller panels off the internet and put any remote access behind a firewall or edge device kept current; move OT onto its own VLAN; change default passwords and add phishing-resistant MFA where feasible; patch firmware and retire end-of-life hardware; allowlist devices and IP addresses; keep offline, tested backups; log, and where a device logs nothing, capture the traffic between assets.
The final recommendation is the one software engineers should steal: set reasonable setpoint ranges on downstream devices and alert on deviations. A refrigeration controller that accepts 50°C as a valid target is, in our vocabulary, a missing input-validation check with a physical blast radius. Bound inputs to physics, enforce the bound as close to the hardware as possible, and alarm through a path the attacker does not also control.
The 30,000-foot read
Cyber-physical attacks used to imply Stuxnet: years of work, a state budget, a centrifuge hall. This campaign, as far as the public record shows, needed controllers that were reachable and a setpoint field that would accept nonsense. That should change how we rank risk. The scary systems are not always the critical ones; often they are the boring ones nobody owns, installed by a contractor, configured once and left to hum for a decade.
Attribution is a political question and may never be answered in public. Exposure is an engineering question, and it has already been answered for anyone willing to scan their own address space. Watch for three things: vendor advisories with CVEs from Danfoss or Copeland, a formal EU attribution, and any confirmed US incident, since the advisory says "globally" but cites none. And if you ship anything with a setpoint and a login page, assume someone out there simply wants it to fail loudly.
Sources: CISA, FBI, HHS, USDA and DoT joint advisory, Nov 5, 2026 (co-authoring agencies, targeted controllers, attack vectors, heating and defrost cycles, denial-of-view, affected sectors, mitigations, absence of vendors, CVEs and attribution); Infosecurity Magazine, Nov 6 (Butera quote, October 11 Danfoss incident, 50°C setting, EFS and Coolworld report, Censys November 2 date and 53% exposure drop for StoreView and XWEB); Infosecurity Magazine, Nov 3 (nine countries, SuperValu, ICA and IKEA details, Danfoss and Copeland, UK NCSC comment, EU commissioner quote, no claim of responsibility); The Star, via AFP, Nov 6 (Peskov denial, European sabotage warnings, hundreds of millions in discarded food); USDA FSIS (0°F freezer and 40°F refrigerator guidance). The European incident details come from secondary reporting, not from the vendors or retailers; no Danfoss or Copeland statement was found. Censys figures are as reported by Infosecurity Magazine; the Censys post itself was not reviewed. The EFS 110°C figure and the AFP loss estimate are single-source and unconfirmed. Sources differ on the date of the second wave (November 1 vs November 2). No attribution has been made by any government cited here.