Five agencies named the freezer. A factory reset is not the close.

CISA, FBI, HHS, USDA and DOT published 5 November. Actors force internet-reachable refrigeration controllers into continuous heat and defrost. EFS caught three blood-bank rooms. Grocery already lost stock. No CVE in the fact sheet.

RWP Ventures · 2026-11-06 · event 2026-11-05 · 17 min read · priority 9.2

Do not collapse five facts.

1. This is the first US five-agency product on the campaign, not a reprint of 13 October. [CERTFR-2026-ALE-012](/posts/2026-10-13-danfoss-ak-sm-certfr-ale-012/) (12 Oct, revised 13 and 16 Oct) named Danfoss AK-SM/AK-SC, then Copeland xweb and Dixell xweb, after French grocers lost cold chain overnight 11–12 October. The 5 November sheet does not name those OEMs. It does name the effect class CERT-FR already saw, and it puts US healthcare, chemical, food, and transport operators on the same queue. Material development is the USG joint plus the 2 November European grocery wave and the EFS blood-bank near-miss, not a new Danfoss CVE.
2. The fact sheet names no CVE, no OEM, and no actor. CISA/FBI: authentication bypass, arbitrary code injection, weak configurations, unpatched or internet-accessible controllers. That is a vector class. Do not brief the CISO that this is CVE-2025-41450. That ID remains 2025 AK-SM 800A background. CERT-FR still has no CVE in ALE-012. Live KEV this run is 2026.11.04 / 1768, dateReleased 2026-11-04T20:00:05Z. No Danfoss, Copeland, or Dixell row.
3. EFS is confirmed process attempt, not confirmed product loss. France’s Établissement français du sang said a refrigeration-equipment provider was hit 2 November. Three blood-bank sites saw cold-room temperature and defrost thresholds set very high. EFS monitoring caught it; no samples or blood products were altered; product was moved; collection and distribution continued. FBI Cyber’s Brett Leatherman, in the 5 November video, names that French blood-service attempt and says no blood was lost. Do not upgrade a caught setpoint change into spoiled plasma.
4. A factory reset is not the close. CERT-FR’s 16 October line still holds: factory-reset on an internet-facing EOL box removes persistence and leaves the hole. CISA’s 5 November list leads with eliminate public internet exposure, then OT VLAN, default-password kill, patch or retire EOL, allowlists, offline backups, logging, and setpoint limits with alerting downstream of the controller. Independent temperature is the safety control. A clean firmware string is not.
5. This is not yesterday’s cPGuard updater, and it is not today’s WordPress clock. [cPGuard](/posts/2026-11-05-cpguard-update-channel-compromise/) was a poisoned Linux hosting update as root. [CVE-2026-119977](/posts/2026-11-04-wordpress-cve-2026-119977-kev/) WordPress Core upgrade-window TOCTOU is due today, 6 November, forensic triage Yes. Keep that FCEB ticket. Do not close a freezer hunt on wp-includes/version.php, or a WordPress hunt on a Danfoss banner.

The operator sentence: if a grocery, cold store, blood bank, pharmacy, chemical plant, or reefer fleet has a temperature controller reachable from the internet, pull the UI today, put a hard setpoint ceiling on the case, and prove an independent alarm still reaches a human. A patched string on an EOL box that is still on 443 is the campaign.

What happened

5 November 2026, USG joint. CISA published the fact sheet and a press release the same day. FBI mirrored the PDF as IC3 CSA 261105 and posted a video. CISA’s Chris Butera: every organization that depends on refrigeration and monitoring systems should assume it could be a target. FBI’s Brett Leatherman: the bureau is seeing these systems targeted across critical infrastructure sectors globally. Reuters, 5 November, paraphrases the same unnamed-actor warning and notes a spate of hacks against commercial freezers in the United States and Europe. Help Net Security, 6 November, is the same sheet.

The fact sheet’s threat paragraph is short enough to keep:

• Targets: electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage.
• Preconditions named: unpatched or internet-accessible.
• Vectors named: authentication bypass; arbitrary code injection; weak configurations.
• Effects named: temperature change (service life, fire hazard, inventory loss, indirect consumer harm); denial-of-view on current temperatures.

No victim table. No CVE. No firmware floor. No attribution.

2 November, second grocery wave (REPORTED by operators and national press; not in the CISA CVE field because there is none). Help Net Security, 2 November: Belgium (Delhaize, Carrefour, Spar among others — Belga: evaporators switched to defrost), Luxembourg (Delhaize), Sweden (Coop and Ica; Ica said a small number of stores outside Ica’s central network). BBC added Finland, Ireland, Estonia, and the Netherlands. Sabcobel’s CEO told Belga the Belgian work started around midnight Sunday and that a thorough fix, for some units, needs a physical modification, not only a software update. Do not treat that last sentence as a CISA finding.

2 November, EFS (CONFIRMED by the operator). EFS: the still-unnamed equipment provider was victimized 2 November. Anomalies on cold rooms using that provider’s solution: temperature and defrost thresholds set very high. Monitoring and alarms identified it; necessary measures taken; no samples or blood products altered. Product moved. Collection and distribution unaffected. EFS working with ANSSI and the French health ministry. Help Net Security, 4 November, is the English paraphrase. FBI video, 5 November, cites the same three sites and the same negative on blood loss.

5 November, Censys sitrep (telemetry, not a victim census). Across Copeland/Dixell XWEB and Danfoss StoreView, internet-exposed hosts fell 53%, 6,695 → 3,124, 9 October to 5 November. Danfoss StoreView 76% (3,004 → 708); Copeland/Dixell XWEB 35% (3,708 → 2,420). First drop was almost entirely France after 11–12 October. Second drop began 2 November across dozens of countries. Censys: the data does not show why hosts went offline. 3,124 still exposed as of 5 November is the operator fact.

Background, not new: [13 October Daily Top](/posts/2026-10-13-danfoss-ak-sm-certfr-ale-012/) and [16 October Weekly OT](/posts/2026-10-16-weekly-ot-danfoss-copeland-siemens/). CERT-FR last version 16 October. Affected systems still: Copeland xweb, Danfoss AK-SC, Danfoss AK-SM, Dixell xweb. Risk still “non spécifié par l’éditeur.”

Not this sheet. CISA did not add a refrigeration CVE to KEV on 5 November. Catalog freeze remains 2026.11.04 / 1768. Newest KEV row is still Apple CVE-2024-27834 (4 November, due 18 November, forensic triage No). WordPress CVE-2026-119977 is due today.

Why it matters

Three operational reasons this is the daily.

First: the process already moved. French grocery overnight 11–12 October lost cold chain. A second European grocery wave on 2 November did it again. EFS on the same day saw blood-bank setpoints driven high and caught it with alarms. CISA’s 5 November text is the US government putting healthcare, chemical, food, agriculture, and transport on that queue, including refrigerated transport. That is not “an ICS research note with a spoilage scenario.”

Second: the safety control is downstream of the hacked box. CISA’s last mitigation is the one grocery and blood-bank operators actually used when it worked: reasonable setpoint limits on devices operating downstream of the controller, plus alerting for deviations. EFS’s monitoring is that control. A controller that can command continuous heat must not be the only thermometer.

Third: EOL plus a public management port is the standing campaign, and KEV will not save you. Danfoss told Cooling Post in October that most of the hit French fleet was already EOL or current-on-old-firmware. CISA’s 5 November list explicitly says identify, retire, and replace legacy devices the manufacturer no longer supports, and points at BOD 26-02 (end-of-support edge) as well as BOD 26-04. There is still no refrigeration CVE on KEV. Waiting for a catalog row is waiting for the next defrost.

Who / what is affected

Confirmed in the 5 November USG sheet:

• Electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage, used also in refrigerated transport.
• Sectors: Healthcare and Public Health, Chemical, Food and Agriculture, Transportation Systems.
• Effect class: remote setpoint / defrost abuse, inventory loss, equipment hazard, fire hazard, denial-of-view, indirect consumer harm if product is later consumed.

Confirmed process events in the window (operator or CSIRT, not the USG census):

• France, 11–12 October: grocery cold-chain loss; CERTFR-2026-ALE-012 product class Danfoss AK-SM/AK-SC, then Copeland xweb and Dixell xweb.
• Europe, 2 November: grocery/small-shop refrigeration disruption reported in Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia, the Netherlands.
• France, 2 November: EFS three blood-bank sites, setpoint/defrost spike, no product loss.

Confirmed not this sheet:

• A named US grocery victim list. Reuters/TechCrunch discuss US and European freezer hacks; the fact sheet does not publish a US victim table.
• A CVE as the exploit path.
• Attribution. The sheet says “malicious cyber actors.” TechCrunch notes researchers have broadly attributed some of the freezer activity to Iran and that US officials have been reported as suspecting Iran. That is REPORTED, not in the CISA/FBI text. Lupovis told Help Net Security it saw default-credential probes against Danfoss AK-SM from 20–30 October from ASNs previously used by Russian adversaries. That is REPORTED probing, not an attribution of the 2 November wave. Do not merge those sentences.
• [cPGuard 5.88.12–5.88.19](/posts/2026-11-05-cpguard-update-channel-compromise/). Hosting IT.
• [CVE-2026-119977](/posts/2026-11-04-wordpress-cve-2026-119977-kev/). Due today. Different product.
• Zyxel CVE-2026-107441. LAN unauth RCE on GS1900; June’s CVE-2026-7273 patch did not stop the in-the-wild exploit; 2.90 Patch 3 is the floor. Not a freezer. Not on KEV.

UNKNOWN / not validated:

• US military commissary freezer malfunctions as a confirmed cyber event in the CISA sheet. TechCrunch cites Reuters that DoD is investigating; that is a separate REPORTED item. Do not put it in the CONFIRMED column.
• Whether the 11–12 October actor, the 2 November grocery actor, and the EFS-provider actor are the same.
• Remaining internet-facing US grocery / blood / pharma / chemical controllers. Censys 3,124 is two European-heavy product families, global, not a US FCEB list.
• Ransomware overlay. Unknown in the sheet.

Technical context

High level. This is not a how-to.

A refrigeration system manager is the thermostat, the defrost clock, and often the alarm path. If that box is on the public internet with a default or bypassable login, the attacker does not need a plant VPN and does not need to write ladder logic. They change a setpoint. CERT-FR’s class was the remote supervisor (Danfoss AK-SM/AK-SC, Copeland xweb, Dixell xweb). CISA’s 5 November class is broader — electronic temperature controllers and commercial refrigeration controllers — and does not freeze the hunt to those four strings.

CISA’s vectors, as written: authentication bypass; arbitrary code injection; weak configurations. Those map, at assessment level, to internet-facing management, default or date-derived credentials, and command injection on the supervisor — the 2025 Team82 / CVE-2025-41450–41452 background on AK-SM 800A, not a confirmed 5 November exploit path. Do not ship a PoC. Do not tell a tech to “try the code of the day.”

ATT&CK mapping (assessed from the USG and CERT-FR record, not a CISA assignment): T1190 Exploit Public-Facing Application; T1078 Valid Accounts (defaults); ICS T0814 Denial of Control / T0836 Modify Parameter (setpoint/defrost). T0809 Data Destruction is not the right label for spoiled food; the food loss is a process consequence of a parameter change.

Censys’s 5 November sitrep is exposure telemetry on the two CERT-FR families. Use it as a “still on the internet” check, not as a compromise list. A host that disappeared after 2 November may have been pulled by the owner, filtered by a provider, or taken down for other reasons. Censys says so.

Threat / exploitation status

What defenders should do

1. Inventory the controller, not the CVE. Grocery, cold store, 3PL, blood, pharmacy, vaccine, chemical, and reefer-fleet: every Danfoss AK-SM/AK-SC / StoreView, Copeland xweb, Dixell xweb, and every other electronic temperature / commercial refrigeration controller with a management UI. Contractor laptops and vendor VPNs count. CERT-FR’s four names are the starting set, not the closed set. CISA did not limit the sheet to those OEMs.
2. Pull public internet exposure today. CISA CPG 3.S. Controller panels off 80/443. If remote access is mandatory: firewall or edge device, current build, allowlisted source IPs. This is the same standing order CERT-FR gave on 12 October. Censys still seeing thousands in the two named families on 5 November means the order is not done.
3. Put a hard ceiling under the hacked box. CISA: reasonable setpoint limits on devices downstream of the controller, plus alerting on deviation. Independent probe temperature that does not trust the supervisor. EFS’s catch was monitoring and alarms, not a firmware bump. If the only alarm path is the box an attacker just logged into, you do not have an alarm path.
4. Defaults and EOL are the exploit. Change default passwords. Phishing-resistant MFA where the product can do it. Firmware where the vendor still ships it. Replace units the manufacturer no longer supports; CISA points at BOD 26-02. CERT-FR: factory reset without removing internet on EOL is recompromise. Sabcobel’s public comment that some Belgian units need a physical change is a vendor-class hint, not a CISA step — ask the OEM; do not invent the procedure here.
5. Segment and log. OT VLAN off the business LAN. Allowlist who can write setpoints. Offline, tested backups of controller config. Where the controller will not log, capture the north-south traffic. Hunt for unexpected defrost commands, setpoint writes, and new management sessions — not for a KEV CVE string.
6. Assume compromise if the UI was public through 2 November. CERT-FR’s rebuild order still applies on those four families: filter to the contractor, factory reset, every available fix, rotate secrets, review accounts, reconfigure, and leave the hole closed. Verify case temperatures with a second sensor before restocking.
7. Keep the IT clocks on other tickets. FCEB: [CVE-2026-119977](/posts/2026-11-04-wordpress-cve-2026-119977-kev/) due today, forensic triage Yes. Ivanti CVE-2026-118527 due 13 November. Apple CVE-2024-27834 due 18 November. Zyxel GS1900: if you applied only the June CVE-2026-7273 (.2)C0 builds, you are still open to CVE-2026-107441 until 2.90 Patch 3. None of those close a freezer.

RWP assessment

This is the daily because it is the first US five-agency statement on a campaign that has already produced confirmed refrigeration process impact, it expands the audience from French grocery to US healthcare, chemical, food, and transport, and the operator error it invites — “we are waiting for a CVE / we factory-reset” — leaves the defrost clock on the internet. Evidence quality is high on the 5 November sheet, the EFS near-miss, and CERT-FR’s still-current product class. Evidence quality is moderate on the 2 November multi-country grocery wave (national press / operator comments, not a new CERT-FR revision). Evidence quality is low on attribution and on treating US military commissary reports as the same event. We are not inventing a KEV row, not assigning CVE-2025-41450 as the 5 November path, not merging Iran or “Russian ASN” probing into the CISA text, not claiming blood-product loss, and not folding WordPress’s due-today clock into OT.

Score 9.2. It outranks WordPress CVE-2026-119977’s FCEB due date (real clock, already the 4 November daily, no new catalog fact), Zyxel CVE-2026-107441 (real material: the June GS1900 patch did not stop the 996-switch exploit; LAN unauth RCE; not KEV; not process impact), Apple CVE-2024-27834 / Sekoia APT29 watering-hole (KEV 4 November, 2024 PAC bypass, forensic triage No, already in yesterday’s daily), and remaining Ivanti 118527 / Brotli / Adobe Commerce due-date clocks.

What we are watching

• Whether CISA or FBI names an OEM, a CVE, or an actor, or adds a refrigeration row to KEV past 2026.11.04 / 1768.
• Whether CERT-FR revises ALE-012 again after the 2 November wave and the EFS incident.
• Whether EFS or ANSSI names the refrigeration-equipment provider.
• Whether a US grocery, blood, pharma, or chemical operator confirms the same setpoint/defrost pattern on the record.
• Censys / equivalent exposure after operators actually pull 443 — 3,124 on 5 November is not zero.
• FCEB today, 6 November: [CVE-2026-119977](/posts/2026-11-04-wordpress-cve-2026-119977-kev/) WordPress Core, forensic triage Yes. Brotli CVE-2026-111497 and Adobe Commerce CVE-2026-48356 due 10 November. VMware ESX CVE-2026-41709 due 11 November. Ivanti CVE-2026-118527 due 13 November. Apple CVE-2024-27834 due 18 November.
• Zyxel CVE-2026-107441 moving to KEV, or remaining a binary-level miss under the CVE-2026-7273 row.

Sources

• CISA — US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems, 5 November 2026
• CISA — Press release, 5 November 2026
• CISA — Joint fact sheet PDF
• FBI IC3 — CSA 261105 PDF
• FBI — Video, 5 November 2026
• CISA — X post, 5 November 2026
• Reuters — US warns of ‘ongoing cyber threat’ to industrial refrigeration systems, 5 November 2026
• Help Net Security — US agencies warn attackers are targeting refrigeration systems, 6 November 2026
• EFS — Incident confirmation
• Help Net Security — Cyberattack hits French blood banks, 4 November 2026
• Help Net Security — Second wave of refrigeration cyberattacks, 2 November 2026
• CERT-FR — CERTFR-2026-ALE-012
• Censys — European Refrigeration Controller Exposure sitrep, 5 November 2026
• TechCrunch — US government warns of ongoing cyber threat, 5 November 2026
• CISA — KEV JSON feed
• CISA — Adds One Known Exploited Vulnerability to Catalog, 4 November 2026
• Zyxel — CVE-2026-107441 advisory, 3 November 2026
• Help Net Security — Patched Zyxel GS1900 switches remained open, 5 November 2026
• [RWP — Danfoss CERTFR-2026-ALE-012, 13 October 2026](/posts/2026-10-13-danfoss-ak-sm-certfr-ale-012/)
• [RWP — Weekly OT, 16 October 2026](/posts/2026-10-16-weekly-ot-danfoss-copeland-siemens/)
• [RWP — WordPress CVE-2026-119977 KEV, 4 November 2026](/posts/2026-11-04-wordpress-cve-2026-119977-kev/)
• [RWP — cPGuard, 5 November 2026](/posts/2026-11-05-cpguard-update-channel-compromise/)