Industrial refrigeration controller attacks — Danfoss StoreView / Copeland Dixell XWEB exploited to spoil food and blood plasma stores
Severity: high · Patch status: partial · Since 2026-11-09
CISA, FBI, HHS, USDA and DOT issued a joint advisory warning that threat actors are actively targeting internet-exposed industrial refrigeration and cold-chain monitoring systems globally. Attackers exploit authentication bypasses, arbitrary code injection and weak configurations to alter temperature settings, force units into continuous heating/defrost cycles, or deny visibility into temperatures, causing fire hazards, equipment damage and inventory loss. In recent weeks hundreds of supermarkets across Belgium, Estonia, Finland, France, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden and the U.K. were hit, with temperatures raised up to 50°C; the French Blood Establishment confirmed plasma storage was affected. Censys counts hundreds of still-exposed Danfoss StoreView (708) and Copeland/Dixell XWEB (2,420) instances. No attacker attribution; mitigation is hardening rather than a single patch.
What to do
- Identify and remove internet exposure of refrigeration/OT controllers immediately
- Change default passwords and enforce strong authentication on all controllers
- Isolate OT devices from corporate and internet networks; remove unnecessary remote access and secure what remains
- Patch and update controller firmware; retire and replace legacy devices
- Audit temperature/defrost settings and alarm logs for tampering; verify cold-chain integrity of stored inventory
Sources
All live incidents on Threat Watch
