Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In late October through November 2026, unknown threat actors conducted a sweeping campaign against internet-exposed industrial refrigeration controllers across Europe, targeting hundreds of supermarkets, food distributors, and medical storage facilities in at least twelve countries. Attackers exploited authentication bypasses, weak default credentials, and unpatched firmware on Danfoss StoreView and Copeland/Dixell XWEB units to remotely manipulate temperature and defrost settings—in some cases forcing units to 50°C (122°F)—resulting in mass food spoilage, financial losses, and equipment hazards. The French Blood Establishment confirmed that three blood plasma storage facilities were compromised. CISA, FBI, HHS, USDA, and DOT issued a joint advisory urging OT asset hardening, network isolation, and removal of unnecessary internet exposure.

This campaign marks a significant escalation in ICS/OT sabotage targeting cold-chain infrastructure—sectors that underpin food safety, pharmaceutical integrity, and public health. With Censys data showing hundreds of controllers still exposed globally and North America accounting for 38% of worldwide ICS exposure, the threat surface remains critically open. Regulators and sector owners face mounting pressure to enforce OT security baselines before similar attacks cross the Atlantic.

Why This Matters Now

Industrial refrigeration controllers remain among the most exposed and least-secured OT assets on the internet, with thousands of Danfoss and Copeland/Dixell units still reachable globally as of November 2026. Attacks have already spoiled food supplies and compromised medical blood plasma storage across twelve European nations. With North America holding 38% of global ICS exposure and no confirmed attribution, escalation is a near-term, high-impact risk for food, pharmaceutical, and healthcare operators.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Threat actors exploited authentication bypasses, arbitrary code injection flaws, and weak or default configurations on internet-accessible Danfoss StoreView and Copeland/Dixell XWEB controllers. These weaknesses allowed remote manipulation of temperature and defrost settings without requiring privileged credentials.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the entire attack chain depended on unrestricted internet reachability of OT management interfaces and flat, unsegmented network paths between co-located controllers. By enforcing identity-aware segmentation and controlled ingress boundaries, CNSF would likely reduce the exposure surface attackers exploited and constrain how far they could move once inside.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Direct internet reachability of OT management interfaces would likely be constrained, reducing the broad exposure that allowed attackers to reach controllers without any prior foothold or credential theft.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: The scope of what an authenticated or bypassed session could reach across the broader OT environment would likely be reduced, limiting how quickly an attacker could escalate influence beyond a single compromised device.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Unrestricted east-west reachability between co-located OT devices would likely be constrained, reducing the blast radius an attacker could achieve after gaining access to a single controller node.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Sustained external command-and-control sessions to OT management interfaces would likely be more visible and constrained, reducing the attacker's ability to maintain persistent, undetected manipulation of device configurations over time.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Uncontrolled outbound data flows from OT controller segments to external destinations would likely be constrained, reducing the attacker's ability to exfiltrate operational telemetry and facility data without detection.

Impact (Mitigations)

Had prior segmentation and egress controls constrained attacker reach, the number of facilities and controller nodes accessible for manipulation would likely have been reduced, limiting the geographic spread of spoilage events and narrowing the scope of physical and public health consequences.

Impact at a Glance

Affected Business Functions

  • Cold-Chain and Refrigeration Monitoring Operations
  • Food and Pharmaceutical Inventory Management
  • Blood Plasma and Medical Supply Storage
  • Industrial Control System (ICS/OT) Availability and Safety
Operational Disruption

Estimated downtime: 14 days

Financial Impact

Estimated loss: N/A

Data Exposure

No confirmed exfiltration of digital data records was reported. The primary impact is physical and operational: temperature manipulation caused spoilage of temperature-sensitive inventory including food products, blood plasma, and medicines at hundreds of sites across at least twelve European countries. At the French Blood Establishment, three facilities storing blood plasma were directly affected by temperature and defrost settings raised to extremely high levels, posing direct public health risks. Financial losses stem from destroyed inventory, equipment damage caused by forced continuous heating and defrost cycles, and potential fire hazards rather than data breach. The scale of exposed internet-accessible ICS controllers (Danfoss StoreView and Copeland/Dixell XWEB) in North America, Europe, and Asia indicates a broad and ongoing attack surface with significant potential for future harm across critical infrastructure sectors.

Recommended Actions

  • • Apply Zero Trust Segmentation (microsegmentation and identity-based policy) to isolate OT/ICS controllers from IT networks and the public internet, ensuring no controller is directly reachable without explicit, policy-enforced authorization aligned with ZTMM.Network and NIST.800-53.AC-6.
  • • Deploy East-West Traffic Security controls to monitor and restrict lateral movement between OT devices within the same network segment, preventing an attacker who compromises one controller from pivoting to adjacent refrigeration or cold-chain systems without detection per NIST.800-53.SC-7.
  • • Implement Multicloud Visibility & Control with centralized traffic observability across hybrid OT/IT environments to baseline normal controller communication patterns and alert on anomalous interactions such as repeated malformed requests or unexpected configuration changes, supporting NIST.CSF.DE.CM-7.
  • • Enforce Egress Security & Policy Enforcement with FQDN-based filtering and outbound traffic controls on OT network segments to prevent unauthorized external connections to and from controllers, limiting attacker ability to sustain command-and-control over internet-accessible management interfaces per NIST.800-53.SC-18.
  • • Enable Encrypted Traffic Protection (HPE/MACsec/IPsec) for all data in transit between controllers, monitoring platforms, and management systems to eliminate packet sniffing and interception of unencrypted operational telemetry, aligning with NIST.CSF.PR.DS-2 and NIST.800-53.SC-12.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image