[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPXzpSwfcUzXGgKpjqLd07MpphtP-4DSJPvJbftOUnao":3},{"article":4,"iocs":54,"watch_terms":65,"solutions":66,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"ff42c9e8-16e5-48d8-bc70-b365dbd9eb49","U.S. urges critical infrastructure orgs to secure refrigeration systems ASAP after EU supermarket and blood bank attacks","u-s-urges-critical-infrastructure-orgs-to-secure-refrigeration-systems-asap-afte-8cfb42","Following recent cyber attacks on French blood banks and European supermarkets, U.S. federal agencies are urging critical infrastructure organizations to immediately secure industrial refrigeration systems against remote tampering and temperature manipulation. Key takeaways Cybercriminals are actively targeting unpatched flaws, misconfigurations, and weak or hard-coded passwords in commercial cold-chain and refrigeration controllers globally. Attackers are gaining remote access to manipulate temperature controls and spoil essential products, such as blood and food. CISA, the FBI, and other U.S. agencies are advising organizations to isolate OT systems, secure or remove remote access, patch critical vulnerabilities, and replace end-of-life devices. Critical infrastructure organizations in the healthcare, chemicals, transportation, and food and agriculture sectors must urgently harden their industrial refrigeration and cold-chain monitoring systems to protect food, medicines, and other essential products against ongoing cyber attacks. That’s the call from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and other U.S. government agencies, following a series of alarming breaches against refrigeration systems in French blood banks and European supermarkets. “Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” CISA Acting Executive Assistant Director for Cybersecurity Chris Butera said in a statement. Attackers are remotely targeting electronic-temperature and commercial-refrigeration controllers used in grocery stores and cold storage facilities. They’re looking for unpatched vulnerabilities and other security flaws, such as misconfigurations, according to the agencies. Once attackers gain remote access to these systems, they try to tamper with these machines’ temperature controls to damage their refrigerated products. The temperature changes could also trigger fire hazards. In a joint fact sheet, the agencies recommend organizations immediately take the following steps: Use strong authentication mechanisms and change systems’ default passwords. Keep systems updated and promptly patch critical vulnerabilities. Replace legacy devices that have reached end-of-life status. Identify systems accessible from the internet. Isolate operational technology (OT) systems from business networks. Remove unnecessary remote access. Secure necessary remote access. Maintain offsite backups. “This fact sheet provides clear, practical steps that network defenders can take to reduce that risk and protect operations,” said Brett Leatherman, cyber branch operations director at the U.S. Federal Bureau of Investigation (FBI), one of the authoring agencies. The U.S. Department of Health and Human Services (HHS), U.S. Department of Agriculture (USDA), and the U.S. Department of Transportation (DoT) also contributed to the joint fact sheet. Attackers hit hundreds of grocery stores in France several weeks ago that caused food to spoil and triggered fires. The National Cybersecurity Agency of France (ANSSI) recently told Cybersecurity Dive it has been investigating the attacks since they started in mid-October and is aware of compromises involving Danfoss AK-SM and AK-SC series controllers, as well as Copeland and Dixell XWEB controllers. How Tenable can help defend against recent cold-chain cyber attacks Recent attacks on cold-chain infrastructure and other types of critical supply-chain infrastructure highlight the importance of asset visibility for security teams. As operational environments become increasingly connected, the line between IT and OT continues to blur, often leaving critical cyber-physical systems inadvertently exposed to the internet. The Tenable One Exposure Management Platform provides comprehensive visibility and actionable intelligence to heed CISA’s warnings and secure converged IT\u002FOT environments. By unifying cyber exposure signals and threat intelligence across your attack surface, Tenable One helps security teams to seamlessly find, prioritize, and secure vulnerable systems before attackers manipulate them. Here are some of the ways Tenable supports security teams across industries in mitigating threats, including AI-assisted attacks, to critical OT systems and supply chain infrastructure: Identify web-exposed assets with attack surface management (ASM): Attackers are actively scanning the web for internet-accessible refrigeration controllers. Tenable One’s external attack surface management (EASM) capabilities allow you to view your infrastructure from an attacker's perspective. By continuously discovering external-facing assets and rogue internet connections, your teams can immediately identify systems accessible from the internet — one of CISA's key directives — and lock down unnecessary remote access points. Achieve ground-truth OT\u002FCPS visibility: To address critical vulnerabilities and identify end-of-life equipment, you need a complete and accurate asset inventory. Tenable’s purpose-built OT security capabilities deliver a comprehensive inventory of all OT, IoT, and IT assets. By querying deep device details, including the specific firmware version of controllers like the targeted Danfoss and Copeland models, as well as associated known vulnerabilities and misconfigurations, Tenable helps eliminate operational blind spots. Visualize attack paths and prevent lateral movement: Threat actors frequently exploit web-exposed IT infrastructure to pivot laterally into critical OT environments. Tenable One maps critical risks and continuously visualizes viable attack paths, showing exactly how attackers could move through your converged IT and OT environment. These insights enable security teams to effectively enforce network segmentation, block malicious communications, and securely isolate OT systems from business networks. Prioritize real-world risk and human safety: With a surge of alerts and limited patching windows, security teams need to know what to fix first. Tenable One correlates vulnerability data with threat intelligence, exploitability, deployed compensating controls, and asset context. This context helps your teams focus remediation on critical exposure findings such as default passwords, remote code execution (RCE), or changes in a device’s running state that pose significant and verifiable risk to production uptime and physical safety. By taking command of your entire attack surface with a unified exposure management strategy, your organization can proactively defend your most critical industrial systems from the evolving global threat of cyber sabotage. Learn more US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems (U.S. government fact sheet) CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity (U.S. government statement) French authorities probe cyberattack targeting nation’s blood supply (Cybersecurity Dive) French blood banks hit alongside cyberattack on European supermarkets (Reuters)","Following cyber attacks on French blood banks and European supermarkets, U.S. federal agencies are urging critical infrastructure organizations to immediately secure industrial refrigeration systems. Attackers are exploiting unpatched flaws, misconfigurations, and weak passwords to remotely manipulate temperature controls, leading to product spoilage and potential fire hazards. Agencies recommend isolating OT systems, securing remote access, patching vulnerabilities, and replacing end-of-life devices.","US agencies warn critical infrastructure to secure refrigeration systems after EU attacks.","https:\u002F\u002Fwww.tenable.com\u002Fblog\u002Fu-s-urges-critical-infrastructure-orgs-to-secure-refrigeration-systems-asap-after-eu","https:\u002F\u002Fwww.tenable.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002F640x360\u002Fpublic\u002Fimages\u002Farticles\u002FUS%20urges%20critical%20infrastructure%20orgs%20to%20secure%20refrigeration%20systems%20ASAP%20after%20EU%20supermarket%20and%20blood%20bank%20attacks.png?itok=4f5tCh0j","2026-11-09T22:00:00+00:00","2026-11-09T22:00:23.607709+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Danfoss","vendor",{"name":21,"type":19},"Copeland",{"name":23,"type":19},"Dixell",{"name":25,"type":26},"AK-SM","product",{"name":28,"type":26},"AK-SC",{"name":30,"type":26},"XWEB","d6f63bb8-0801-486a-be7f-171400700454",{"id":31,"icon":33,"name":34,"slug":35},null,"IoT\u002FOT","iot-ot",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,61,63],{"type":56,"value":57,"context":58},"malware","Danfoss AK-SM","Compromised refrigeration controller series",{"type":56,"value":60,"context":58},"Danfoss AK-SC",{"type":56,"value":21,"context":62},"Compromised refrigeration controller brand",{"type":56,"value":64,"context":58},"Dixell XWEB",[18,21,23],{"controls":67,"vendors":155},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":98,"name":99,"problem":100,"products":101},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"slug":127,"name":128,"problem":129,"products":130},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",[],{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":168},"unpatched-and-misconfigured-refrigeration-systems-targeted-in-critical-infrastructure-attacks","Unpatched and Misconfigured Refrigeration Systems Targeted in Critical Infrastructure Attacks","Attackers exploited a combination of unpatched vulnerabilities, misconfigurations, and weak passwords in industrial refrigeration systems to remotely manipulate temperature controls — causing spoilage of blood supplies and food products, and creating potential fire hazards. These OT (Operational Technology) systems were likely internet-exposed with little to no network isolation, making them easy targets for remote exploitation. The incidents highlight how legacy industrial control systems are frequently overlooked in standard patch and hardening cycles, leaving life-safety consequences on the table. When critical infrastructure OT systems are treated as 'set and forget' rather than actively managed assets, attackers can weaponize them with minimal effort.",[161,162,163,164,165,166,167],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(b)":169,"NIST SP 800-53 SI-2: Flaw Remediation":170,"CIS Control 12: Network Infrastructure Management":171,"OWASP A06:2021 Vulnerable and Outdated Components":172,"CIS Control 7: Continuous Vulnerability Management":173,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":174,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":175},"NIS2 explicitly requires essential and important entities to implement incident handling and vulnerability management measures, which applies directly to the critical infrastructure operators whose refrigeration systems were compromised.","This control mandates identifying, reporting, and correcting system flaws in a timely manner — directly addressing the unpatched vulnerabilities that enabled attackers to compromise the refrigeration control systems.","The lack of network segmentation allowed attackers to reach OT refrigeration systems remotely; proper network infrastructure management requires isolating critical operational systems from internet-accessible networks.","The use of unpatched and end-of-life refrigeration control components mirrors this risk category, underscoring the danger of running outdated software and firmware in any internet-connected system.","Attackers exploited known unpatched flaws in refrigeration systems; a continuous vulnerability management program would have identified and remediated these weaknesses before they could be exploited.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action — a process that would have driven patching and hardening of the exposed refrigeration systems.","Weak passwords on refrigeration systems gave attackers easy remote access; this framework function requires enforcing strong authentication and access controls to protect critical assets."]