European supermarkets and blood banks hit by cyberattack on internet-connected refrigeration systems
Researchers say hackers probed Danfoss refrigeration controllers across nine European countries before launching attacks that forced stores and French blood banks to discard spoiled goods, raising concerns about the security of connected infrastructure.
Cybersecurity firm Lupinus detected a wave of reconnaissance targeting Danfoss AK-SM refrigeration controllers in Europe during the last week of October, followed by coordinated attacks on November 2-3 that forced supermarkets in nine countries and several French blood banks to switch fridges and freezers to defrost mode, raising internal temperatures up to 50 °C. The incidents caused widespread spoilage of perishable goods.
Lupinus CEO Xavier Bellekens said the firm observed 276 intrusion attempts from 91 distinct threat actors, with a sharp peak on October 26. The company uses honeypot systems that mimic client networks to lure attackers and monitor their methods.
"Between the 20th and 30th of October, we saw a wave of what we call reconnaissance… adversaries were trying default passwords and known vulnerabilities," Bellekens told Euronews Next.
Analysis of the malicious traffic indicated the use of "bullet-proof" hosting services previously linked to Russian groups, though the firm cautioned that server location does not prove the attackers' nationality. Bellekens noted that the attacks were limited to European sensors, required rapid coordination across multiple countries, and appeared to be carried out by a capable, possibly state-backed actor.
Technology editor George Nott said the breaches relied on basic security flaws such as exposed internet-facing controllers and factory-default credentials, rather than sophisticated exploits. He warned that similar weaknesses could affect other connected equipment in retail, healthcare, logistics and data-centre environments.
Security experts highlighted that many organizations treat connected physical systems as facilities-management issues rather than part of their IT security scope, despite the EU's NIS2 Directive requiring risk management for all networked assets. Kumar Sokka, CEO of Acre Security, warned that the same vulnerabilities could compromise building access controls, cameras, alarms and HVAC systems.
Looking ahead, Gianni Cuozzo, founder and CEO of Exein, warned that artificial-intelligence tools could accelerate the discovery and weaponisation of such flaws, urging manufacturers to embed runtime defence mechanisms in devices.
National cyber agencies have described the events variously as a “cyberattack” or a “cyber incident,” while the EU Agency for Cybersecurity (ENISA) has stopped short of labeling them an attack.