San Francisco Frontiers - IoT Refrigerator Hacks Disrupt Blood Labs and Supermarkets Across Europe and US

A wave of cyberattacks targeting internet-connected refrigerators has disrupted operations at blood banks in France and caused significant food waste across supermarket chains in at least 11 European countries. The incidents, which involved unauthorized control of cooling systems leading to dangerous temperature spikes, have reignited concerns about the security of critical infrastructure devices.

The Établissement Français du Sang (EFS), France’s national blood agency, confirmed on Wednesday that cold rooms storing blood and plasma bags were affected on November 2. According to the EFS, the refrigeration units were "raised to very high temperatures." The organization stated that no blood samples were damaged because staff and alarm systems detected the anomaly quickly, allowing for immediate fail-safe measures.

The French incident is part of a broader pattern of attacks affecting commercial cold storage. In recent days, supermarket chains in multiple European nations reported similar disruptions, with refrigeration units failing and causing large volumes of perishable goods to spoil. Pictures circulating online from across the continent show discarded food following the temperature failures. This follows a wave of similar attacks in October that forced hundreds of French stores to discard inventory, as well as incidents in August involving roughly six commissaries and grocery stores on United States military bases.

The Pentagon is currently investigating the attacks on US military installations and has collaborated with French law enforcement, Reuters reported last week. While Russian hacktivists attempted to claim responsibility for some of the disruptions, they failed to provide credible evidence. The Kremlin also denied involvement. However, researchers have identified potential links to Iran-linked actors. NextGov/FCW reported that unnamed US officials suspect Iranian attackers may be behind the freezer incidents on military bases, though investigations remain ongoing.

Experts note that many of the hacks exploited vulnerabilities in temperature controllers manufactured by the Danish firm Danfoss. Researchers indicated that the attacks were not technically complex to execute. Danfoss did not respond to requests for comment regarding the specific exploits used. In previous statements, the company noted that impacted systems were running outdated firmware and urged customers to update their products.

On Thursday, the US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert warning that attacks could exploit flaws in cold storage systems through authentication bypasses, arbitrary code injections, and weak configurations. The agency highlighted long-standing warnings about the threats posed by insecure internet-of-things (IoT) devices.

Josh Corman, a critical infrastructure researcher and executive in residence for public safety and resilience at the Institute for Security and Technology, emphasized that the attacks highlight a growing disconnect between technological dependence and security capacity. "It's been true for more than a decade now that our dependence on connected technology is growing faster than our collective will to protect it, which has exposed us to accidents, adversaries, and now potentially agents," Corman said. "These fragile cold-chain systems are too critical to fail, but we keep experiencing hard lessons."

The first wave of attacks against French supermarkets last month appears to have been caused by attackers exploiting unpatched refrigeration controllers exposed to the internet. Some of these devices allegedly used weak passwords derived from dates. Sweden’s National Cyber Security Center issued an advisory noting that many businesses continue to use older technology as systems become increasingly connected. The center recommended that companies inventory their connected devices, disconnect them when possible, and ensure remaining units are access-controlled, patched, and monitored.

Refrigerator attacks are not a new phenomenon in the context of geopolitical conflict. In 2022, 16 supermarkets in Russia were targeted at the start of the country’s full-scale war with Ukraine. Additionally, a 2025 report by Danfoss noted that 40 stores in Israel were similarly attacked that year.

It remains unclear whether all recent incidents are connected or carried out by multiple distinct actors. The EFS confirmed that while the blood samples were not altered, the incident serves as a stark reminder of the risks associated with basic security lapses in critical infrastructure.

E.Cruz--SFF