The Établissement Français du Sang (EFS) confirmed Wednesday that cold rooms holding blood at three French sites were pushed to unusually high temperatures on November 2 during a broad campaign of attacks on internet-connected refrigerators. The EFS said alarm systems and staff caught the change quickly and fail-safe measures were applied, so the blood was neither altered nor damaged.
The same wave of refrigerator attacks has hit supermarket chains in at least 11 European countries in recent days, driving temperatures sharply upward and forcing large quantities of food to be discarded. Similar attacks in October led hundreds of French stores to throw out food. In August, about six commissaries and grocery stores on US military bases suffered comparable incidents that spoiled food; the Pentagon is investigating and working with French law enforcement, according to Reuters.
Researchers say the first recent wave against French supermarkets appears to have come from attackers exploiting unpatched refrigeration controllers that were exposed to the internet, including software versions that allegedly used weak passwords based on the date. Many of the intrusions involved flaws in temperature controllers made by the Danish firm Danfoss, and researchers say the attacks would not have been hard to carry out. Danfoss did not respond to a request for comment and has said affected systems were running outdated firmware, urging customers to keep products updated.
In a Thursday alert on the incidents, the US Cybersecurity and Infrastructure Security Agency said the attacks could exploit flaws in cold storage systems through authentication bypasses, arbitrary code injection and weak configurations. Longtime critical infrastructure researcher Josh Corman, now executive in residence for public safety and resilience at the nonprofit Institute for Security and Technology, said connected technology has outpaced efforts to protect it for more than a decade, and that fragile cold-chain systems are too critical to fail.
Who is responsible remains unclear, and investigators have not established whether all the incidents are linked or involve multiple actors. Russian hacktivists claimed responsibility for some attacks without providing credible evidence, and some researchers see signs of Russia-based involvement in at least some cases; the Kremlin denied involvement this week. Other cases show possible ties to Iran-linked actors, and NextGov/FCW reported that unnamed US officials suspect Iran-linked attackers in the freezer attacks on US military bases while the investigation continues.
Such attacks predate this year. According to a 2025 report by Danfoss, 16 supermarkets in Russia were targeted in 2022 at the start of the country's full-scale war with Ukraine, and 40 stores in Israel were similarly attacked that year. Sweden's National Cyber Security Center, in a recent advisory, noted that many businesses use older technology as their systems become more connected and advised companies to inventory internet-connected devices, disconnect them where possible, and keep those that must stay online access-controlled, patched and monitored.
More cybersecurity news from TechManNews.
