From supermarkets to blood banks: Europe’s fridge hacks escalate

France’s national blood service, the Établissement Français du Sang (EFS), confirmed a cyberattack on November 1 that disrupted refrigeration systems storing blood plasma and platelets. Hackers remotely altered temperature settings in three cold storage sites, pushing levels from -30°C to as high as 110°C.

Technicians intervened before any products were compromised, but the incident underscores the vulnerability of critical healthcare infrastructure to cyber-physical threats. The attack is part of a coordinated wave targeting refrigeration systems across Europe, including supermarkets in at least 11 countries.

Over the past weeks, hackers have targeted refrigeration systems in supermarkets across Europe, causing temperatures to spike to 50°C in stores in Belgium, Sweden, Ireland, and eight other countries. In October, Dutch retailer Albert Heijn was hit by an attack that shut down its websites, delivery services, and parts of its store operations. The U.S. military also reported suspected cyberattacks on commissary refrigeration systems in August. Authorities suspect state-sponsored actors or lone-wolf hackers, though no group has claimed responsibility.

How the attacks unfolded

The cyberattacks leveraged flaws in refrigeration controllers. These vulnerabilities allowed hackers to bypass authentication using a hidden daily password and execute remote commands to manipulate temperature settings.

In the EFS case, the attackers targeted systems supplied by Coolworld, forcing freezers to defrost and risking the spoilage of blood plasma, which must be stored below -25°C. The French cybersecurity agency CERT-FR had previously warned about these vulnerabilities, urging organizations to remove public internet access and restore remote access via secure VPNs. Despite these alerts, over 2,765 Danfoss refrigeration systems remained exposed to the internet.

Response and mitigation efforts

The EFS acted quickly to mitigate the impact, with its technicians promptly detecting the anomaly and transfering blood products to other facilities, preventing any damage. The agency also reinforced temperature monitoring and alerted France’s national cybersecurity agency, ANSSI, and the health ministry.

Meanwhile, EU officials convened an emergency meeting of the interinstitutional Task Force, involving ENISA and Europol, to coordinate a response. National authorities in Italy, Belgium, and Sweden launched investigations, with some treating the incidents as deliberate attempts to disrupt critical supply chains. The UK’s National Cyber Security Centre warned that AI-powered malware could exacerbate such threats in the coming years.

This attack highlights once more the systemic vulnerabilities of the so-called operational technology (OT) systems, often overlooked in cybersecurity strategies.  Many refrigeration controllers lack basic protections, such as strong authentication or network segmentation, making them easy targets for remote manipulation.

The incidents have forced retailers and healthcare providers to reassess their OT security posture, with experts recommending Zero Trust segmentation, inline enforcement, and multicloud visibility. The EU’s NIS2 Directive and DORA framework now require stricter cybersecurity measures for critical infrastructure, but compliance remains inconsistent. The financial and operational fallout from these attacks underscores the need for urgent action.