Hackers target European supermarket refrigeration and French blood-service cold storage

Unidentified hackers targeted refrigeration systems at supermarkets across Belgium, Sweden and the UK and at cold-storage facilities operated by France’s national blood service this week, while hoax bomb threats disrupted at least 25 commercial flights across Europe on Nov. 5.

Hackers reached refrigeration systems at three regional blood banks in France overnight between Sunday and Monday. The French Health Ministry said intruders reached cold-storage monitoring and control systems at regional facilities of the French Blood Establishment, known as EFS. Staff received alerts and moved blood products to refrigerators outside the compromised network, leaving supplies unaffected. EFS spokesperson Charley Dubois said, “We have staff round the clock since blood can be needed at any time.”

The Health Ministry said the situation was under control by Wednesday and it had disabled remote access to the affected refrigeration systems. Officials are still investigating how the attack happened, which equipment the attack might have affected, and when service can safely resume.

On Monday, suspected cyber attacks on refrigeration systems affected grocery stores in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, Portugal and Sweden. Other reporting puts the number of affected countries at eight. The disruptions came after someone remotely raised thermostats on refrigeration units in seven European countries earlier in the week, in some cases pushing temperatures to 50 degrees Celsius.

The Epoch Times said Belgian and Luxembourg operators Delhaize and Colruyt, along with Carrefour, reported impacts at multiple locations, while Fox Business put the number of affected Delhaize supermarkets in Belgium and Luxembourg at about 40 and added that other incidents occurred in Sweden, Ireland, the Netherlands, Estonia and Finland.

Epoch Times and RTE.ie reported that 13 SuperValu stores in Ireland lost refrigeration, forcing staff to pull some chilled and frozen products from shelves, and that owner Musgrave said the incident ended on Monday evening. Bizclik Media Ltd said 23 ICA stores in Sweden lost refrigeration and freezer function, and eight of those stores threw out refrigerated and frozen goods. UK freezers belonging to members of the British Association of Independent Meat Suppliers reached 100 degrees Celsius.

One French chain estimated losses in the tens of millions of euros for a single day of disruption, the Epoch Times reported, and Finance Minister Roland Lescure said the disruption affected roughly 700 of 10,000 supermarkets and called it a wake-up call for food security. Frozen-food retailer Picard kept its systems in-house and avoided disruption in October’s attacks, RTE.ie reported.

Hoax bomb threats caused disruption across European aviation early in the week. At least 25 commercial flights faced disruption on Nov. 5, with some forced to make emergency landings, and seven planes faced searches or diversions on Nov. 3 after malicious bomb alerts. Investigators found no suggestion that a hostile terror group or state actor orchestrated the threats, though investigations continue. As one observer put it, “airlines receive bomb threats on a daily basis, at a rate that we would find extraordinary if we knew.”

US federal agencies warned on Thursday that hackers are targeting refrigeration systems used to store food and medicine. The agencies said they are seeing continuing malicious activity aimed at temperature controls and commercial refrigeration controllers that lack patches or are reachable over the internet. These systems are widely used across transportation, healthcare, chemical, and food and agriculture operations. If attackers succeed, they could alter temperatures, force nonstop heating or defrost cycles, and create dangers such as spoiled inventory, damaged equipment and possible fire hazards.

CISA acting executive assistant director for cybersecurity Chris Butera said, “Every organization that depends on refrigeration and monitoring systems should assume it could be a target.” FBI Cyber Branch Operations Director Brett Leatherman said the agency is seeing these systems targeted across critical infrastructure sectors around the world. US officials did not attribute the European incidents to any specific group and said they have not confirmed detecting similar attacks inside the United States.

Operators should take refrigeration controllers off the public internet, swap out default or weak passwords, install available patches, retire unsupported legacy devices, and restrict or secure any remote access that is still necessary.

Operational technology – the systems companies use to monitor and control infrastructure, often through automation and with physical-world effects – often links to internet networks, opening them to cyber attacks. Some affected SuperValu stores relied on refrigeration controls supplied by Danish company Danfoss, which let engineers check temperatures and change settings without visiting the shop. Researchers at Claroty identified security weaknesses in Danfoss refrigeration controllers before the attack and reported the findings to Danfoss, which released software updates. Starting next year, the EU Cyber Resilience Act will require manufacturers to tell customers how long products will continue to receive security updates.

Outside contractors looked after refrigeration controls at affected French supermarkets, and some of those contractors may not have installed patches for recently found security flaws. Danfoss said the affected gear in France ran the range from older systems without security updates to newer models on outdated software. Some controller models carry passwords as simple to guess as the current date, while some shop owners did not realize their fridges were online. Ireland has not publicly said which controller models and software versions the attack involved.

Picard, a frozen-food retailer, kept its systems in-house and avoided disruption in October’s attacks.

The Irish National Cyber Security Centre said on Monday that the latest incident might stem from a known vulnerability, and that operators need to secure internet-facing management interfaces, keep them up to date and maintain them in line with established cybersecurity best practices. Danfoss said it warned customers in the past three weeks to block internet access to refrigeration systems and avoid direct online connections. CERT-FR said operators should cut direct internet access to affected systems and allow remote access only through a secure VPN or protected network.

Singapore’s cyber agency said no similar attacks have been reported there, but it urged organisations to strengthen their defences. CSA Commissioner Gwenda Fong said, “They remind us that even sectors which may not traditionally consider themselves cyber targets can be vulnerable.” The agency said weak remote access to operational technology could allow attackers to change equipment settings, interrupt operations and create safety hazards. Healthcare facilities, cold storage and logistics, building management, manufacturing, water treatment, and energy and utilities face similar risks.

SingCERT told organizations with remotely accessible operational technology to cut direct internet links to management interfaces, improve authentication and access controls, swap out default passwords, use VPNs and multifactor authentication, and limit entry to authorized staff. Organizations should also patch and secure operational technology, set up network segmentation and security monitoring, and review end-of-life or unsupported equipment. Incident response plans must allow operators to safely isolate affected systems and return to local or manual controls where possible, while keeping critical operations running.

CSA said the fallout can reach beyond data loss to hit business operations, supply chains and essential services. For cold-chain operations, interrupted temperature controls could put product safety and supply chains at risk.

The Army Criminal Investigation Division’s Cyber Field Office is working with the Defense Commissary Agency and the Defense Criminal Investigative Service to figure out why refrigeration failed in at least six military commissaries in August. Commissaries serve grocery needs for military personnel and their families at bases. Former FBI Special Agent Nicole Parker warned that cyber attacks on grocery stores could happen in the United States.

Those responsible for the week of disruption have not been identified and could be hostile states, criminal gangs or teenagers. A cybersecurity researcher told Guardian technology editor Dan Milmo that test attacks on Danfoss fridge controls bore the hallmarks of Russia-linked operations. No group has claimed responsibility for the European supermarket attacks.

Hacking groups described as pro-Russian – NoName057(16) and Z-Pentest Alliance – claimed in Telegram posts that they jointly hacked Danfoss technology, but their involvement in the supermarket attacks has not been independently established. Denmark’s military intelligence agency has blamed Z-Pentest for a destructive 2024 attack on a Danish waterworks and said NoName057(16) ran attacks that overwhelmed Danish websites ahead of local elections in 2025. A cybersecurity specialist said she saw no clear financial motive in the supermarket attacks and suggested the attackers might simply have wanted to cause unrest. It remains unclear whether Monday’s incidents and October’s attacks came from the same perpetrators.