A series of cyberattacks targeting internet-connected refrigeration systems has impacted critical infrastructure across Europe and the United States, raising concerns about the security of the global cold chain. The incidents, which involve unauthorized access to temperature controllers, have resulted in the spoilage of significant quantities of food and the disruption of sensitive medical storage facilities. While the attacks have occurred over several months, the most recent activity has drawn heightened attention due to the potential impact on public health and military logistics.
The Établissement Français du Sang (EFS) confirmed that on November 2, cold storage units containing blood and plasma were subjected to unauthorized temperature increases. The organization stated that while the internal temperature of the units rose to high levels, the blood samples remained intact because staff and automated alarm systems identified the breach and activated fail-safe protocols. This incident follows a broader wave of activity affecting supermarket chains across at least 11 European countries, where similar remote adjustments to refrigeration settings led to widespread food spoilage.
These events are part of a recurring pattern of exploitation. In August, approximately six commissaries and grocery stores located on United States military bases reported similar temperature-tampering incidents. The Pentagon is currently investigating these breaches in coordination with French law enforcement. Furthermore, hundreds of French supermarkets reported being targeted in October, resulting in the loss of large volumes of inventory. Similar attacks were documented as early as 2022, when supermarkets in Russia and Israel were targeted, according to historical data from the refrigeration equipment manufacturer Danfoss.
The attacks primarily involve the exploitation of vulnerabilities in temperature controllers manufactured by Danfoss. Investigations suggest that the perpetrators are targeting devices that are directly exposed to the internet and running outdated firmware. In some instances, the systems were reportedly secured with weak, predictable passwords based on calendar dates. The United States Cybersecurity and Infrastructure Security Agency (CISA) issued an alert on November 6, warning that these systems are susceptible to authentication bypasses, arbitrary code injection, and insecure configurations.
Danfoss has acknowledged the incidents, stating that the impacted systems were operating on legacy firmware. The company has urged its customers to ensure that all connected devices are updated to the latest software versions. While the manufacturer has not provided specific details regarding the total number of compromised units, security researchers have noted that the barrier to entry for these attacks is relatively low, given the lack of basic security hygiene on many internet-of-things (IoT) devices.
Attribution for the current wave of attacks remains unconfirmed. While various hacktivist groups have attempted to claim responsibility for the disruptions, none have provided verifiable evidence to support their claims. Some security researchers have suggested potential links to Russia-based actors, though the Kremlin has officially denied any involvement. Separately, United States officials have indicated that they are investigating potential ties to Iran-linked actors regarding the attacks on military base commissaries, though that investigation remains ongoing.
The persistence of these attacks has prompted national cybersecurity agencies to issue guidance for organizations relying on connected cold-storage infrastructure. The Swedish National Cyber Security Center recently advised businesses to conduct comprehensive inventories of all internet-connected devices. The agency recommended that organizations disconnect unnecessary devices from the internet, implement strict access controls, and ensure that any required connections are continuously monitored and patched.
Security experts emphasize that these incidents serve as a critical reminder of the risks associated with the rapid integration of IoT technology into essential infrastructure. The reliance on legacy systems that were not designed with modern security requirements in mind has created a fragile environment where basic lapses in configuration can lead to significant real-world consequences. As these systems become increasingly interconnected, the challenge of securing them against both accidental failure and deliberate malicious interference remains a primary concern for public safety and national security.
