Cyberattacks disrupt refrigeration systems across 13 countries

SOCRadar reports a multi‑wave campaign targeting refrigeration and other OT systems linked to critical infrastructure, beginning in October 2026 with widespread defrost disruptions in France and expanding to 13 countries by early November. Wave 1 hit about 700 French supermarkets on 11 October, followed by a second wave affecting food businesses in 13 countries on 2 November.

A contractor for France’s national blood service saw cold rooms ramped to 110°C (230°F) on 1–2 November, and three UK meat suppliers were struck through Copeland XWEB controllers. On 5 November, five US agencies warned of ongoing attacks against refrigeration and cold‑chain systems. Claims of attribution circulate online, but as of 9 November 2026, government bodies had not named a perpetrator.

The attackers reportedly relied on exposed management interfaces and weak configurations rather than zero‑days or bespoke malware. Evidence points to default credentials on internet‑accessible interfaces for initial access, with six or more US military commissaries experiencing overnight defrost failures in August 2026 that the Pentagon treats as a suspected cyberattack.

The campaign involves several controller families: Danfoss AK‑SM 800A/800, AK‑SC 355, Copeland and Dixell XWEB (including EVO variants), and Carel pCOWeb, plus related devices such as E3 Site Supervisor. CVEs cited in the discourse include CVE‑2025‑41450 (authentication bypass), CVE‑2025‑41451 (authenticated command injection), CVE‑2025‑41452 (management interface disruption), CVE‑2026‑21718 (Copeland XWEB PRO), and CVE‑2025‑6519 to CVE‑2025‑52551 (Frostbyte10 family).

Firmware fixes cited include Danfoss 4.3.1 and 1.13 for Copeland XWEB Pro, with XWEB EVO offline per Copeland’s guidance. Authorities caution that attribution remains unconfirmed.