Exposed Danfoss and Copeland controllers targeted in 2026 cold-chain incidents across Europe
US agencies documented active exploitation of refrigeration controllers causing inventory loss and fire risk. Exposure metrics from Censys confirm hundreds of devices remain reachable despite rapid declines after public alerts. The incidents fit a wider pattern of low-sophistication attacks on exposed OT assets across critical infrastructure.
Censys data records Danfoss StoreView exposures falling from 3,004 on 9 October 2026 to 708 by 5 November while Copeland/Dixell XWEB instances dropped from 3,708 to 2,420; the same datasets show North America retaining 38 percent of global ICS exposure. Joint CISA-FBI-HHS-USDA-DOT advisory details authentication bypass and code injection paths that enable remote temperature overrides to 50 °C or continuous heating modes, directly matching observed spoilage at Belgian, French, German and UK grocers plus three Établissement Français du Sang sites. The pattern aligns with prior documented exposures of fuel-tank gauges, air-raid sirens and water-treatment HMIs, indicating a persistent operational focus on minimally protected OT endpoints rather than sophisticated zero-days. Official statements stop short of attribution; technical indicators remain limited to targeting of legacy, default-credential devices with no independent confirmation of state involvement. Legacy replacement timelines and removal of direct internet access remain the only controls with measurable effect; continued exposure above 2,000 Copeland units signals that voluntary patching alone will not close the attack surface before additional sectors are tested.
Sources (2)
- [1]CISA Joint Advisory AA26-XXX(https://www.cisa.gov/news/2026/11/refrigeration-controller-advisory)
- [2]Censys Internet-Wide Scan Report November 2026(https://censys.io/reports/ics-exposure-2026-11)