CrunchAtlasGuide
CISA refrigeration advisory. What to do now.
What the November 5 federal warning means for refrigeration operators, which systems to check, and why monitoring matters.
If you only read one thing.
The federal warning calls for secure access, active monitoring, and alerts when refrigeration conditions become unsafe. 1
Find exposed controllers
Remove direct internet exposure and secure necessary remote access.
Review access and changes
Check device logs and network communications for unexpected activity.
Verify operating conditions
Maintain safe setpoint limits and reliable alerts for deviations.
01 · Immediate actions
What operators should check now.
On November 5, CISA, the FBI, HHS, USDA, and the Department of Transportation urged refrigeration and cold-chain operators to take eight actions. 1
- Remove direct internet exposure. Do not leave refrigeration control panels publicly accessible. Secure required remote access behind updated edge protection.
- Separate operational networks. Put refrigeration and other OT devices on a dedicated VLAN, apart from business networks.
- Secure credentials. Change defaults, use strong password policies, and apply phishing-resistant MFA where feasible.
- Update firmware. Patch supported devices and identify equipment that is no longer maintained by its manufacturer.
- Restrict access. Allow only approved devices and IP addresses to reach interfaces that can change settings.
- Test backups. Keep current offline and offsite backups and confirm they can be restored.
- Monitor and report. Review available logs; collect network traffic between OT assets when logs are missing or nonstandard.
- Check operating limits. Maintain safe downstream setpoint ranges and alerts for deviations.
Coordinate changes with refrigeration and facilities personnel. Disconnecting access or changing settings without understanding the system can disrupt operations.
02 · Affected systems
Which controllers are named?
In October, France's CERT-FR reported numerous compromises involving remote refrigeration controllers. Its alert names Danfoss AK-SM and AK-SC series, Copeland XWEB, and Dixell XWEB. 2
- Confirmed compromises in France
- CERT-FR identified affected controller families and advised operators to remove internet exposure, review configurations, and secure remote access.
- Broader U.S. federal warning
- The November 5 fact sheet addresses malicious activity targeting industrial refrigeration and cold-chain monitoring systems globally, not just the named French installations. 1
A product family appearing in an alert does not mean every installed device is compromised. Confirm models, firmware, remote-access paths, and manufacturer guidance.
03 · How attacks happen
Why connected refrigeration is exposed.
Supermarkets, warehouses, food processors, and healthcare facilities use remote management to check temperatures, receive alarms, manage defrost schedules, and support equipment without sending a technician to every site. The connection has a purpose. A publicly exposed management interface does not.
The federal warning identifies authentication bypass, arbitrary code injection, and weak configurations as possible routes into unpatched or internet-accessible controllers. After gaining access, attackers may alter settings or force continuous heating and defrost cycles. The initial access method is not established for every incident. 1
Defrost and temperature changes are legitimate commands. An unauthorized person can use those same functions at the wrong time, and the controller may carry out the instruction without an ordinary software error.
Remote service access belongs in the review. Know which refrigeration contractors can connect, what they can reach, and who removes their access when it is no longer needed.
Review third-party ICS access04 · Continuous monitoring
Monitor access, changes, and actual temperatures.
Prevention reduces exposure. Monitoring helps teams investigate suspicious activity and recognize unsafe conditions. Refrigeration systems need three different kinds of evidence.
Network and remote access
Look for unfamiliar connections, unexpected destinations, unusual access times, and communication outside approved paths.
Controller changes
Record setpoint changes, defrost schedules, alarm changes, and administrative actions wherever the equipment supports it. Check whether changes were authorized.
Physical conditions
Use appropriate independent temperature readings, equipment status, and safety alarms to confirm that refrigeration is actually operating within safe limits.
Network evidence may show suspicious access without identifying a specific setpoint change. Controller logs may show a change without proving it was authorized. A separate temperature alarm may reveal unsafe conditions without explaining the cause.
The federal guidance recommends collecting network communications when OT logs are unavailable and alerting on deviations from safe setpoint ranges. 1
What network detection and response can showCan you investigate access to the control network?
Talk with our team about the network evidence available around your OT environment.
05 · Suspected compromise
If you suspect a controller was compromised.
Treat this as a safety and security incident. Protect stored products and confirm actual operating conditions while IT, security, facilities, and refrigeration personnel coordinate the response.
Do
- Verify temperatures and equipment status using trustworthy measurements.
- Preserve controller settings, access logs, timestamps, and network evidence where safe.
- Use manufacturer recovery guidance and secure the original access path.
Don't
- Assume a normal-looking display proves inventory is safe.
- Reset equipment or cut access without coordinating operational safety.
- Assume a factory reset removes an unpatched vulnerability or ongoing exposure.
CERT-FR warns that resetting unsupported equipment without removing its exposure can leave it vulnerable to compromise again. 2 U.S. organizations can report suspicious activity to CISA at 1-844-729-2472 or through the FBI Internet Crime Complaint Center. 1
06 · Where CrunchAtlas fits
Where CrunchAtlas fits.
AtlasCyber passively analyzes IT and OT network evidence to identify suspicious communications, connect related activity, and support investigations. For refrigeration environments, this can help examine unexpected access and traffic where the relevant network evidence is available.
It does not operate refrigeration equipment, verify product temperatures, or automatically establish that a setpoint change was malicious. Coverage depends on the traffic and telemetry collected.
07 · FAQ
Refrigeration security, answered.
Is the federal advisory a cybersecurity product requirement?
No. The agencies recommend protective measures, including logging, network traffic collection when OT logs are unavailable, and setpoint deviation alerts. They do not require or endorse a particular commercial product.
Can a controller show normal temperatures during a cyber incident?
A normal display alone does not establish that conditions are safe. The federal warning identifies loss of visibility into current temperatures as a possible effect. Verify conditions using appropriate independent measurements.
Is a factory reset enough after a compromise?
Not necessarily. CERT-FR warns that an unsupported device left exposed to the internet can be compromised again. Follow manufacturer recovery guidance and correct the underlying exposure.
08 · Sources
Sources.
Government reporting and recommendations are distinguished from CrunchAtlas guidance and product capabilities.
- CISA, FBI, HHS, USDA, and DOT, US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems, November 5, 2026
- CERT-FR, Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, October 12–16, 2026
This page summarizes public guidance and is not equipment-specific repair advice. Apply manufacturer instructions and operational safety procedures. The federal agencies do not endorse CrunchAtlas or other commercial products.
Keep reading.
Know what reaches your refrigeration controllers.
Talk with our team about visibility into communications across your refrigeration and OT networks.
Talk to our team Sign up for our newsletter