- Authoring Security Agencies: Cybersecurity and Infrastructure Security Agency (CISA) and FBI；Issued urgent joint advisory on remote controller compromises
- Geographic Impact Scope: Spanned at least 10 European nations including France and Germany
- Extreme Temperature Manipulation: Remote defrost commands forced setpoints up to 50°C and 110°C
- Targeted Industrial Hardware: Danfoss StoreView and Copeland/Dixell XWEB interfaces；Internet-exposed devices rapidly plunged 53% following emergency offline actions
- Direct Economic & Health Damage: Discarded thousands of tons of spoiled groceries worth millions；French Blood Establishment (EFS) successfully safeguarded plasma via alert
Attackers hit Danfoss and Copeland/Dixell controllers
The United States Cybersecurity and Infrastructure Security Agency (CISA), in direct coordination with the Federal Bureau of Investigation (FBI), published an urgent joint industrial cybersecurity advisory alerting North American operators of cold-chain logistics, food storage, and pharmaceutical networks against sophisticated operational technology (OT) cyberattacks. The federal intervention follows an unprecedented wave of destructive intrusions across Europe, where malicious threat actors gained unauthorized access to internet-connected refrigeration control systems, remotely forcing commercial freezers into continuous defrost cycles to spoil inventories.
According to authoritative technical advisories from French cybersecurity agency ANSSI and European investigators, the cyber offensive targeted widely deployed industrial refrigeration controllers manufactured by Danfoss (such as the AK-SM series) and Copeland/Dixell XWEB systems. Many of these operational panels were directly exposed to the public internet without virtual private network (VPN) boundaries, frequently utilizing factory-default administrative credentials. Exploiting authentication bypass and remote command execution vulnerabilities, attackers systematically altered operational parameters across supermarkets in France, Belgium, the Netherlands, Germany, and six other European states.
The sabotage campaign targeted critical public health infrastructure during the early morning hours of November 2, when threat actors breached remote monitoring software supplied by refrigeration vendor Coolworld to infiltrate cold storage facilities at three regional centers of the French Blood Establishment (Établissement français du sang, or EFS). Court documents and agency disclosures revealed that attackers reconfigured control thresholds to an astonishing 110 degrees Celsius in an effort to destroy life-saving frozen blood plasma and transfusion supplies stored at minus 30 degrees Celsius. Catastrophe was narrowly averted when automated physical temperature alarms alerted on-call medical technicians, who manually isolated the machinery and relocated the clinical biological reserves.
EFS plasma sabotage and grocery losses across Europe
In the retail commercial sector, however, grocery syndicates including Intermarché and Edeka sustained severe losses. Hundreds of commercial retail refrigeration banks remained stuck in defrost mode for hours, forcing operators to condemn and landfill thousands of tons of frozen food products, yielding estimated cumulative damages reaching tens of millions of euros.
Cybersecurity strategists and industrial engineering experts underscored that the coordinated European cold-chain attacks illustrate a dangerous evolutionary leap in operational technology threats. By moving beyond conventional ransomware extortion to weaponize physical industrial control hardware, threat actors demonstrated their capability to inflict severe economic disruption and jeopardize critical medical supply chains. The joint CISA and FBI advisory serves as an urgent wake-up call for cold storage operators, demanding immediate multi-factor authentication enforcement, comprehensive asset visibility, and absolute network segmentation to protect perishable food and life-saving biological assets.
