European freezer attacks escalate to French blood bank contractor
Attackers have warmed internet-connected freezers at supermarkets and food companies across 13 European countries and have now hit France's EFS blood service: the intrusion came through Coolworld, the contractor maintaining the storage containers, and freezers holding donor samples were reprogrammed from -30°C to 110°C. A technician caught the change in time and France's Health Ministry says there was no operational impact. Organizations running connected refrigeration should restrict remote access to controllers and monitor temperature alarms.
What happened
Attackers hijacked internet-connected refrigeration controllers and pushed freezer temperatures to 50°C, forcing more than 100 stores in at least nine countries to discard spoiled food overnight on November 2. It is the second wave: around 700 supermarkets in France were hit in October, according to the Paris prosecutor's office. Le Canard Enchaîné reports the campaign reached France's EFS blood service through contractor Coolworld, with freezers reprogrammed from -30°C to 110°C and caught before damage.
Why it matters
Supermarkets lost entire frozen-food stocks, with damage expected to run into the millions, according to BNO; the EU agriculture commissioner calls the attacks a deliberate attempt to disrupt the food supply chain. Targets are legacy Danfoss, Copeland and Dixell controllers no longer receiving security updates, used by retailers, butchers and now medical infrastructure. Any company with connected refrigeration is exposed to physical stock loss, beyond data risk.
What to do
Follow Danfoss's October 13 guidance: cut refrigeration systems' internet connections and reconnect only through a secure network. Inventory how many management interfaces are exposed, Censys counted just over 1,000 Danfoss StoreView units online worldwide, and monitor temperature alarms. Plan replacement or isolation of end-of-life equipment; installer Sabcobel says affected units need physical modification, not just a software update.
For the technical team
- Affected
- Danfoss Controladores de refrigeração conectados à internet fabricados pela Danfoss, sem atualizações de segurança; supermercados e empresas de alimentos em 13 países europeus, da Irlanda à Romênia, e agora t · Danfoss AK-SM and AK-SC controllers; CERT-FR later expanded its alert to Copeland and Dixell XWEB systems. Copeland equipment also targeted in Belgium, per NOS. Danfoss says most hacked units were legacy products out of support; Censys mapped just over 1,000 Danfoss StoreView interfaces exposed worldwide, with 220 in France, 138 in Belgium, 51 in the Netherlands and 50 in Sweden.
- Exploitation
- Active exploitation confirmed by retailers and agencies. First wave overnight October 11-12: around 700 victims in France, according to the Paris prosecutor's office, including Intermarché, Carrefour, Coopérative U and Monoprix. Second wave overnight November 2: more than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, with problems also reported in Finland, Italy and Portugal; the UK NCSC confirms a couple of instances exploited in Britain. Belgium's federal prosecutor opened an investigation; no group has claimed responsibility.
- Fix
- No patch for legacy models: Danfoss says most hacked units no longer receive updates and Beaumont notes many devices are end-of-life with no available patch. Danfoss mitigation (October 13): cut systems' internet connections and reconnect only through a secure network; Sabcobel says affected units also need physical modification. Censys estimates part of the exposed instances run patched firmware: 41% in France, 68% in Belgium, 37% in the Netherlands and 58% in Sweden.
- Vector
- Management interface of refrigeration controllers reachable from the internet, mostly legacy equipment with no fix; attackers forced evaporators into defrost mode and reset temperatures as high as 50°C (70°C per BNO). Lupovis recorded, from October 20 to 30, login attempts using factory-default credentials publicly documented by Danfoss plus fingerprinting of Danfoss components, all rejected by its sensors, peaking on October 26. Researcher Kevin Beaumont says every freezer hit in the second wave had a management interface reachable from the internet.
- More details
- Claroty warned in August that the units were at risk of remote hacks. Exposure in France fell from 1,825 to 220 Danfoss interfaces after the October attacks, per Censys. Belgium's CCB says it fears targeted use of AI in the attacks but does not know if AI was used, and the perpetrators are unknown. Danfoss cited earlier campaigns with its controllers: Russian supermarkets at the start of the Ukraine invasion and 40 Israeli stores lacking firewall or VPN. The EU Cyber Resilience Act will require manufacturer support from December 2027; the EU will discuss the attacks at its next Security College meeting, and Sweden's NCSC is monitoring with European counterparts.
Timeline
Le Canard Enchaîné details the EFS blood-service attack: entry via Coolworld, donor-sample freezers reprogrammed from -30°C to 110°C, and no operational impact per France's Health Ministry.
Reports say the refrigeration campaign escalated to medical infrastructure: intruders hit Coolworld, a French national blood bank contractor, raising plasma deep-freeze temps from -30°C to 110°C, caught before harm.
Second wave in weeks hits British supermarkets, following the first in France.
Want the next updates in your inbox? Get the daily edition →
See all 34 updates
Campaign spreads to 13 European countries from Ireland to Romania, with units pushed to 50°C; no one has claimed responsibility and no indicators of compromise have been published.
New reports indicate the refrigeration-system attack, which changes freezer temperatures, is hitting supermarkets across Europe, echoing last month's French retailer case.
The UK's NCSC confirmed a couple of instances of exploited vulnerable technology in Britain, following attacks that spoiled millions of euros worth of food across Europe, BBC reports.
Reports detail the attack's impact: freezers reaching 50°C, rotting meat, melted ice cream and stores discarding all spoiled stock.
Social media post claims freezer attacks now leave empty shelves in nine countries, adding Luxembourg, the Netherlands, Poland, Ireland, Finland and Estonia to the known list.
A new wave overnight into November 2 extends the attacks to Estonia and other countries, with stores discarding food.
SecurityWeek reports a new wave: more than 100 stores hit, including Ireland beyond Belgium and Sweden.
Security outlet reports a second wave of attacks: intruders remotely changed cooling settings, in some cases to 50°C, and stores had to discard food.
Social media reports indicate the refrigeration attack may have reached seven European countries, also including the Netherlands, Luxembourg, Ireland, Finland and Estonia.
EU calls the hacks a deliberate attempt to disrupt the food supply chain; stores in more than eight countries have now been hit.
CNBC reports the attack knocked out fridges and freezers at dozens of supermarkets across Belgium and Luxembourg.
Social media post on the second wave cites more than 500 freezers disabled across Europe in under a month, with food spoiled.
Reuters reports a fresh wave of the attack hitting stores from Sweden to Belgium, echoing last month's incident in France; a control-systems worker cites outdated firmware, controllers on public-facing IPs and abuse of the defrost cycle to raise temperatures.
Batch identifies end-of-life Danfoss controllers as the target, with Ahold Delhaize and Colruyt confirming stores and Israel's cyber agency warning retailers.
Sweden's National Cyber Security Centre confirms investigation; reports cite seven countries hit and more than 50 stores affected in Belgium alone, with total food loss at some locations.
A post on X suggests supermarket fridges in Poland may also have been hit by the wave; the claim is unconfirmed.
New reports describe simultaneous freezer attacks in five countries; in Sweden, ICA Kvantum stores in Sjöbo and Tomelilla and at least six Coop stores were hit, one with equipment set to 50°C, and tons of food had to be discarded.
Batch adds an overnight attack on a Danish food producer, stopped in time by its refrigeration supplier, and Denmark's civil security agency warning to patch controllers and restrict internet access.
Reports add Finland to the list of affected countries and cite more than 40 supermarkets hit in Belgium and Luxembourg with heavy food losses; posts attribute the temperature manipulation to a flaw in refrigeration control software.
New report adds Finland to the affected countries and cites temperatures of about 50°C; it also mentions a Washington, D.C. substation failure with no confirmed attack.
The Daily Telegraph counts about 70 stores hit across the continent and reports the UK is on alert over food security fears.
Post reiterates the second wave of the attack and adds Carrefour and Spar among the Belgian chains hit, with remote activation of defrost mode pushing temperatures up to 50°C.
UK puts Tesco and Sainsbury's fridges on alert; reports on the campaign cite temperatures as high as 80°C.
Batch adds Ireland and the Netherlands to the country list and dates the new wave to November 1-2.
BleepingComputer recaps the disruption of refrigeration systems at European supermarkets, with no new details beyond existing coverage.
TechCrunch confirms the second wave within a month, spoiling food and disrupting supplies across European countries.
New reports raise the overnight total to more than 70 stores, add at least six Coop shops in Sweden, and note the Pentagon probe into more than seven US military bases.
The Record reports a second wave of suspected freezer attacks on supermarkets across Europe early Monday.
Wave reaches Estonia after cases in Belgium, Sweden and Luxembourg: a large chain's freezer was pushed to +50°C, and Kitman Coldtech's CEO cites several clients targeted via older controllers.
Coop chain added as affected in Sweden alongside ICA; a store manager in Sjöbo reports discarding frozen food worth hundreds of thousands of kronor.
Incident opened.
Sources 29 sources
- @BNODesk @BNODesk
- @CoffeReport @CoffeReport
- @coinbureau @coinbureau
- @InsiderGeo @InsiderGeo
- Second wave of suspected cyberattacks hits supermarket freezers across Europe The Record
See all 30 sources
- @TGLetter @TGLetter
- @visegrad24 @visegrad24
- @MarioNawfal @MarioNawfal
- @BullTheoryio @BullTheoryio
- A fresh wave of cyberattacks has hit Europe's supermarket refrigerators, destroying food across countries TechCrunch Security
- @BleepinComputer @BleepinComputer
- @karinamichelin @karinamichelin
- @jurgen_nauditt @jurgen_nauditt
- @Xking332 @Xking332
- @PolitlcsUK @PolitlcsUK
- @Pirat_Nation @Pirat_Nation
- @lordivan22 @lordivan22
- @WeTheBrandon @WeTheBrandon
- @InsiderGeo @InsiderGeo
- @HormuzLetter @HormuzLetter
- @IntCyberDigest @IntCyberDigest
- @SkyNews @SkyNews
- @ThayzzySmith @ThayzzySmith
- @biobio @biobio
- @OMApproach @OMApproach
- @PicturesFoIder @PicturesFoIder
- @trajektoriePL @trajektoriePL
- @_Patriot1776Q_ @_Patriot1776Q_
- @allenanalysis @allenanalysis
- @YourAnonOne @YourAnonOne
