Who Can Reach Your Refrigeration Controller? Five Federal Agencies Want You to Find Out

Fifty degrees Celsius. One hundred twenty-two Fahrenheit, inside a supermarket freezer cabinet. Palo Alto Networks Unit 42 reports that figure as the high end of what the European refrigeration attacks produced, and it is what a temperature controller does when somebody with access sets it to heat and walks away. The first wave ran on October 11 and 12 and cost roughly 700 French supermarkets their stock. The second ran overnight on November 1 and 2 and hit between 100 and 115 retail locations across at least ten more European countries. Some units caught fire. On November 5, CISA, the FBI, the Department of Health and Human Services, the USDA and the Department of Transportation published a joint fact sheet telling American operators to take industrial refrigeration and cold-chain monitoring controllers off the public internet.

Here is the relevance verdict. You are in scope if any refrigeration you own or lease reports its temperature to something: a walk-in cooler or freezer with a networked panel, a blast chiller, a cold room, a vaccine or blood fridge in a clinic, a reach-in with a monitoring gateway bolted to it, or refrigerated transport with telematics. That covers grocers, convenience stores, restaurants, food manufacturers, pharmacies, dental and medical practices, breweries, florists, labs, and every cold-storage and third-party logistics operator in the country. You are out of scope if every unit you own is a standalone box with a mechanical thermostat and no data connection of any kind. Confirm that with your refrigeration contractor rather than assuming it, because the connection is usually theirs, not yours. No American wave has been reported. The news for a US reader is the advisory and the exposure data behind it, not an incident.

What the European stores lost, and in what order

France's national CERT published alert CERTFR-2026-ALE-012 on October 12, one day into the first wave, and updated it on October 16. The alert names four product families: Danfoss AK-SC series, Danfoss AK-SM series, Copeland xweb and Dixell xweb. It lists no CVE. It says CERT-FR is aware of numerous compromises, that the campaigns are probably ongoing, and that a compromised unit may hold persistence which survives until a factory reset. It then adds the sentence that matters most operationally: a factory reset removes the persistence and leaves the device exactly as vulnerable as it was before.

The second wave reached Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Unit 42 also reports that refrigeration at French medical facilities was affected, and the French Blood Establishment confirmed that an incident at one of its refrigeration equipment providers changed temperature and defrost settings at three plasma storage sites. There is no evidence that blood products spoiled. On November 3, the pro-Russian groups NoName057(16) and Z-Pentest claimed the campaign on Telegram. Unit 42 treats those claims as unverified, and so should you.

The defenders' response is visible in the scan data. Censys counted 1,825 Danfoss StoreView instances exposed in France before October 11. By October 14 the count was 537. At the time of its second-wave analysis it was 220, of which 41 percent were running patched firmware. Hundreds of French operators pulled their panels off the internet inside three days. The second wave landed on the countries that had not.

The password is a function of the clock

The federal fact sheet lists four weaknesses behind these intrusions: authentication bypass, arbitrary code injection, weak configurations, and unpatched or internet-accessible controllers. Press coverage has split between "authentication bypass" and "default credentials" as if they were competing theories. On the Danfoss AK-SM 8xxA line, the public record says they are closer to the same finding.

CISA advisory ICSA-25-140-03, first published in May 2025 and revised that August, carries three CVEs from Claroty's research on that series. CVE-2025-41450 is the one that reaches an unauthenticated attacker, and its description is four words of root cause: datetime-based password generation. The controller derives a password from the date and time. CWE-287, improper authentication, CVSS v3.1 8.2. It is fixed in release R4.2. CVE-2025-41451 is CWE-77 command injection through the alarm-to-mail configuration fields, post-authentication remote code execution, CVSS v4.0 8.7. CVE-2025-41452 is external control of a configuration setting leading to denial of service. Both are fixed in R4.3.1.

Read those together and the practical consequence is awkward. Changing the admin password on an AK-SM 8xxA running pre-R4.2 firmware does not close CVE-2025-41450, because the credential the bug produces is not one you set. That is why the federal fact sheet lists "change default passwords" and "apply patches" as two separate actions rather than one, and it is the reason CERT-FR insists that a factory reset leaves the device re-compromisable. Note also what CISA said in 2025 about these flaws: no known public exploitation, high attack complexity. Fifteen months later a national CERT reported numerous compromises of the same product families. Treat "high attack complexity" as a statement about the first attacker, not the hundredth.

One more detail worth checking by hand. The R4.3.1 download linked from ICSA-25-140-03 points at a file named SM800A-4.2.4.spk, the same package linked for R4.2. Verify the version you actually installed on the panel instead of trusting the link you clicked.

Your external scan will not find the controller

Censys published a companion piece on what this campaign reveals about industrial control exposure generally, and one number in it should change how you look for your own units. About 70 percent of hosts running industrial control devices sit on consumer and mobile networks. In the United States, China and Canada, roughly a third of observed exposed control hosts sit on a single mobile carrier. Between 31 and 99 percent of hosts speaking a control protocol also answer on HTTP, SSH or FTP.

That is the shape of the small-business cold chain. The refrigeration contractor needs remote access to the panel for alarm callouts and service visits, so the install includes a cellular modem or a second broadband line, billed to facilities and never mentioned to whoever runs IT. The controller is therefore not in your corporate address space, and an external scan of your own netblocks returns nothing. The device is on the internet under a carrier's IP, perfectly reachable, and absent from your inventory.

Censys counts just over 1,000 Danfoss StoreView instances exposed worldwide. Unit 42's Cortex Xpanse counted more than 5,000 internet-exposed devices from the manufacturers CERT-FR named, measured on November 5 and 6. The two numbers describe different fingerprints, and the gap between them is the argument for doing your own count. Start from the units, not from the network: get the panel addresses from the contractor, then check what each one answers from outside. The web root's Last-Modified header tracks the firmware build date, which is the same signal Censys used to tell patched panels from unpatched ones.

#!/usr/bin/env bash
# controller_recon.sh - date the firmware on refrigeration panels you own.
# Run this ONLY against addresses you control. One host per line in
# controllers.txt, as supplied by your refrigeration contractor.
set -u

while read -r host; do
  [ -z "$host" ] && continue
  hdr=$(curl -sS -m 8 -k -D - -o /dev/null "https://${host}/" 2>/dev/null) \
    || hdr=$(curl -sS -m 8 -D - -o /dev/null "http://${host}/" 2>/dev/null) \
    || { printf '%-24s unreachable\n' "$host"; continue; }

  code=$(printf '%s' "$hdr" | awk 'NR==1{print $2}')
  srv=$(printf  '%s' "$hdr" | awk 'tolower($1)=="server:"{sub(/^[^ ]+ /,""); print}')
  built=$(printf '%s' "$hdr" | awk 'tolower($1)=="last-modified:"{sub(/^[^ ]+ /,""); print}')

  printf '%-24s http=%-4s server=%-20s firmware_build=%s\n' \
    "$host" "${code:-none}" "${srv:-unknown}" "${built:-none}"
done < controllers.txt

Any panel that answers that script from an address outside your own network is reachable by everyone else too. A build date older than the vendor's fix is your patch list.

Put the contractor behind a door you control

CERT-FR is specific about the fix order, and it rules out the shortcut most shops reach for first. Filtering the contractor's source addresses on the firewall is acceptable as an emergency measure and not as the permanent arrangement; the permanent arrangement is a VPN or a protected network. The federal fact sheet says the same thing in CPG terms: remove the controller's internet exposure, isolate it on a dedicated operational-technology VLAN away from the business network, allowlist the devices permitted to make changes, and enable logging.

Before you cut anything, read your insurance policy. CERT-FR tells operators to check their contract conditions before severing the data uplink to the refrigeration contractor, because continuous temperature monitoring is often a condition of spoilage and cold-chain coverage. Pulling the cable to fix a security problem and voiding the claim that pays for the stock is a bad trade. Schedule the cutover with the contractor and keep the monitoring path alive through the VPN.

# /etc/nftables.d/refrigeration.nft
# VLAN 60 holds the refrigeration panels. The contractor arrives on the
# vendor VPN interface and nowhere else. Everything is logged (CPG 3.Q).
table inet ot {
  set contractor_vpn {
    type ipv4_addr; flags interval
    elements = { 10.60.250.0/29 }      # pool issued to the vendor VPN group
  }
  set panels {
    type ipv4_addr
    elements = { 10.60.10.11, 10.60.10.12, 10.60.10.13 }
  }

  chain forward {
    type filter hook forward priority filter; policy drop;

    ct state established,related accept

    iifname "wg-vendor" ip saddr @contractor_vpn ip daddr @panels \
      tcp dport { 80, 443 } ct state new \
      log prefix "ot-panel-allow " accept

    iifname "wan0" ip daddr @panels \
      log prefix "ot-panel-wan-drop " drop

    ip saddr @panels ip daddr 10.0.0.0/8 \
      log prefix "ot-panel-egress " drop
  }
}

On Danfoss hardware, CERT-FR also says to set the security level to Strict and change the passwords after the firmware update, in that order. Any AK-SM 800 without the A suffix, or an AK-SC 355, has no fix available. Those belong behind the VPN permanently, or on the replacement schedule the fact sheet asks for under CPG 2.A and 2.B.

Alert on the setpoint, not only on the temperature

The last item in the federal mitigation list is the one nobody implements: define reasonable setpoint limits for downstream devices and alert on deviations. Most cold-chain monitoring watches the measured temperature, which means it fires after the product is already warm. An attacker who moves the setpoint to heating, or drives a continuous defrost cycle, is visible in the configuration an hour before the thermometer agrees. The fact sheet also names denial of view as an impact in its own right: losing sight of the current temperature counts as the attack succeeding.

If you already scrape panel readings into a monitoring system, three rules cover the campaign's whole observed behaviour.

# prometheus/rules/cold-chain.yml
groups:
  - name: cold-chain
    rules:
      # The setpoint itself left the band an engineer signed off on.
      - alert: RefrigerationSetpointOutOfBand
        expr: refrigeration_setpoint_celsius > -16 or refrigeration_setpoint_celsius < -30
        for: 5m
        labels:
          severity: critical

      # Over an hour of defrost in a two-hour window is not a defrost schedule.
      - alert: RefrigerationDefrostRunaway
        expr: increase(refrigeration_defrost_seconds_total[2h]) > 3600
        for: 10m
        labels:
          severity: critical

      # Denial of view: the panel stopped reporting at all.
      - alert: RefrigerationTelemetryStale
        expr: time() - refrigeration_reading_timestamp_seconds > 1800
        for: 15m
        labels:
          severity: warning

Route all three to a human who can reach the store, not to a mailbox the contractor reads on weekdays. The French stores found out from the smell.

Ask the contractor which firmware is on the panel

The whole exposure in a small business usually lives in one answer from one vendor. Send your refrigeration contractor three questions this week: what is the make, model and firmware version of every controller you have installed for us; what is the public IP address of each one, and whose circuit is it on; and what does your remote access path look like now that CERT-FR has published CERTFR-2026-ALE-012. An unwilling or vague answer is itself the finding. A clear one gives you a patch list, an inventory, and a VPN project you can finish in a week.

The gap this campaign exposed sits where facilities procurement meets the network, which is precisely where nobody owns the risk. We assess that boundary for small and mid-size operators: what of yours answers from the public internet, which of it was installed by a vendor, and what the contract says about who patches it. Bring the contractor's answers to a session and we will work through them with you.