Three French sites managing blood and plasma bags were briefly impacted this week by widespread attacks targeting vulnerable internet-connected refrigerators. The Établissement Français du Sang confirmed on Wednesday that cold rooms preserving blood saw their temperatures raised significantly on November 2, though staff and alarm systems quickly intervened to prevent any damage to the blood samples.
Widespread Grocery and Military Base Impacts
This incident follows a broader wave of cyberattacks over recent days that affected supermarket chains across at least 11 European countries, raising refrigerator temperatures and resulting in large volumes of food being discarded. Similar attacks in October forced hundreds of French stores to throw away food, while roughly six grocery stores and commissaries on US military bases experienced spoiled food due to comparable incidents in August. Reuters reported last week that the Pentagon is currently investigating these events and cooperating with French law enforcement.
Longtime critical infrastructure researcher Josh Corman, the executive in residence for public safety and resilience at the nonprofit Institute for Security and Technology, noted that dependence on connected technology continues to outpace collective protection efforts, exposing society to accidents, adversaries, and agents. He added that these fragile cold-chain systems are critically important, yet the public keeps experiencing hard lessons.
Vulnerabilities and Attribution
It remains unclear who is responsible for the attacks and whether they are linked or executed by multiple actors. The initial wave against French supermarkets last month apparently stemmed from attackers exploiting unpatched refrigeration controllers exposed to the internet, including software versions reportedly using weak passwords generated from dates.
Numerous hacks originated from flaws in temperature controllers produced by Danish firm Danfoss, with researchers indicating the attacks were relatively easy to execute. Danfoss did not respond to a request for comment from WIRED.
In other statements, Danfoss asserted that affected systems operated on outdated firmware and urged users to maintain product updates. The US Cybersecurity and Infrastructure Security Agency issued an alert on Thursday warning that attackers could exploit cold storage system vulnerabilities through authentication bypasses, weak configurations, and arbitrary code injections, highlighting long-standing warnings from experts regarding internet-of-things device weaknesses in critical infrastructure.
Although Russian hacktivists attempted to claim responsibility for certain attacks without offering credible evidence, some researchers detected potential indicators of Russia-based involvement in a portion of the incidents. The Kremlin denied any involvement this week. Regarding the US military base freezer attacks, NextGov/FCW reported last week that unnamed American officials suspect Iran-linked actors, though investigations remain ongoing.
Similar refrigerator and freezer attacks occurred in the past, including 2022 incidents targeting 16 supermarkets in Russia at the onset of the full-scale war with Ukraine, alongside 40 stores attacked in Israel that same year, as documented in a 2025 Danfoss report.
Sweden’s National Cyber Security Center emphasized in a recent advisory regarding the freezer hacks that numerous businesses rely on older technology as systems become increasingly interconnected, recommending that companies inventory connected devices, disconnect them when possible, and ensure they remain monitored, patched, access-controlled, and kept offline if connection is unnecessary.
