Hackers targeted internet-connected refrigeration systems across Europe in the days before a series of cyber incidents disrupted supermarkets and blood banks, raising questions about the security of everyday equipment that increasingly depends on remote digital controls.
The incidents, which took place on 2 and 3 November, affected supermarket refrigeration systems in nine European countries and several blood banks in France. In some cases, attackers gained access to refrigeration controls and switched equipment into defrost mode, causing temperatures to rise as high as 50 degrees Celsius. The disruption left some grocery stores unable to keep food at safe temperatures, forcing them to dispose of spoiled products.
The attacks exposed weaknesses in the security of connected refrigeration equipment, particularly systems that can be managed remotely over the internet. They also raised a wider concern: if hackers can interfere with supermarket fridges, could similar weaknesses allow them to disrupt hospital equipment, building security systems or data centres?
Cybersecurity company Lupovis believes the incidents may have been preceded by a coordinated period of preparation. Its researchers detected suspicious activity targeting systems associated with Danish refrigeration manufacturer Danfoss in the days before the attacks.
Between 20 and 30 October, Lupovis recorded more than 276 attempts from 91 different threat actors matching specific components of Danfoss controllers. Activity peaked on 26 October before stopping towards the end of the month.
Xavier Bellekens, chief executive of Lupovis, described the activity as a period of reconnaissance, during which attackers appeared to be testing default passwords and known vulnerabilities.
Lupovis monitors cyber threats through a network of so-called honeypots. These are systems designed to imitate real online infrastructure and attract hackers, allowing researchers to observe how attackers search for weaknesses and attempt to gain access. The technology gives cybersecurity teams an opportunity to study malicious activity without exposing their clients’ actual systems.
The company said its monitoring systems identified the suspicious activity before the November incidents. Bellekens compared the process to burglars driving through a neighbourhood and identifying properties they intend to break into later.
The findings have led Lupovis to investigate whether the attacks were part of a wider, organised operation rather than isolated attempts by individual hackers.
The company traced digital evidence linked to the activity and found that some of the infrastructure involved used what is known as bulletproof hosting. These are hosting services that are often designed to resist complaints, takedown requests and law enforcement action.
Bellekens said some of the hosting providers identified by Lupovis had previously been associated with Russian hacking groups. However, he cautioned that the location or ownership of a hosting service does not establish the nationality or identity of the people using it.
Lupovis has not identified the attackers and has not established that Russia was responsible. Bellekens said the pattern of activity nevertheless raised questions about whether a state-linked actor could have been involved.
He also pointed to the geographical distribution of the suspicious activity. According to Lupovis, its sensors in South America, Africa, North America and Asia did not record the same pattern. The activity was detected by its European sensors.
The timing of the incidents was another factor. Several attacks took place within a 24-hour period, suggesting that whoever was responsible had the ability to coordinate activity across different countries.
Bellekens said the findings did not resemble the work of an inexperienced hacker or a lone individual. In his assessment, the operation appeared organised enough to raise the possibility of state involvement. He nevertheless acknowledged that the available evidence was not sufficient to identify a particular government.
Other observers have urged caution about drawing conclusions. George Nott, technology editor at The Grocer, said the attacks appeared to have exploited relatively basic security weaknesses rather than sophisticated hacking techniques.
According to Nott, attackers were able to find refrigeration systems through login pages exposed to the public internet and exploit weak passwords and vulnerabilities for which fixes were already available.
He also said the motive remained unknown. No ransom demand or public claim of responsibility had been reported in the material surrounding the incidents. Without further evidence, the perpetrators could have been anything from state-sponsored hackers to individuals acting without a wider political or financial objective.
There has also been some variation in how European authorities have described the incidents. Belgium, Luxembourg, Italy, Portugal and Estonia referred to them as cyberattacks, while Sweden and Ireland used the term cyber incident. The European Union Agency for Cybersecurity (ENISA) also stopped short of explicitly classifying the incidents as a cyberattack in its joint statement.
The method used to access the refrigeration systems highlights a problem with the growing number of machines connected to the internet. The affected equipment included controller boxes that allowed operators to monitor and manage refrigeration units remotely. While remote access can make equipment easier to operate, systems that are directly exposed to the internet can become accessible to attackers if they are not properly protected.
Bellekens said placing these systems behind virtual private networks (VPNs) could have significantly reduced the risk. A VPN restricts access to authorised users and makes it harder for outsiders to reach the equipment directly.
Weak login credentials added to the problem. Some systems were reportedly accessible using factory-default usernames and passwords, including combinations such as “Supervisor” and “12345”. When organisations fail to replace these credentials or restrict remote access, attackers have a much easier route into connected equipment.
Nott said retailers often give greater attention to protecting payment systems and customer information, while overlooking the security of other connected machinery. That approach can leave equipment responsible for basic store operations exposed.
Refrigeration is only one part of the problem. Supermarkets increasingly depend on connected heating, ventilation and air conditioning systems, electronic shelf labels and automated floor-cleaning equipment. If these devices have weak security or outdated software, they could also become targets.
The concern extends beyond retail. Kumar Sokka, chief executive of Acre Security, said the same types of connected controllers used in refrigeration systems are also found in modern buildings. They can manage doors, access-control readers, surveillance cameras, alarms, lighting and heating systems.
A successful intrusion into these systems could have consequences that are less immediately visible than spoiled supermarket food. In an office, hospital or data centre, an attacker might interfere with door access, disable a camera or prevent an alarm from working. Such disruption could create serious security and operational problems without leaving obvious physical evidence.
Sokka also identified logistics, warehousing, healthcare and manufacturing as sectors where similar weaknesses could have consequences. These industries rely on connected equipment to manage buildings, monitor operations and maintain essential services.
European cybersecurity rules already place responsibilities on certain organisations to protect their network and information systems. The EU’s NIS2 Directive requires organisations within its scope to manage cybersecurity risks, including asset management, security measures and incident handling.
ALSO READ: Why Are Supermarket Fridges Connected to the Internet? Cyberattacks Expose a Growing Security Risk Across Europe
However, Sokka argued that organisations do not always apply these responsibilities to physical equipment. Cybersecurity programmes often concentrate on conventional IT infrastructure such as computers, servers and email systems, while refrigeration, access control and building management are treated as maintenance responsibilities.
He said organisations need to recognise that these connected systems are also part of their digital attack surface and assign clear responsibility for protecting them.
The rapid development of artificial intelligence could make the problem harder to manage. Gianni Cuozzo, founder and chief executive of Italian cybersecurity company Exein, warned that AI is reducing the time needed to identify a vulnerability and turn it into a working attack.
Manufacturers of connected devices may struggle to keep pace with the speed at which new weaknesses are discovered, particularly when equipment remains in service for many years. Refrigeration systems, industrial machinery, healthcare equipment and building controls can continue operating long after their original software and security arrangements have become outdated.
Cuozzo argued that organisations should not depend entirely on software updates and network protection. Connected devices should also be designed to recognise and block activity that falls outside their intended functions, including attacks that exploit vulnerabilities before manufacturers have released a fix.
The supermarket incidents have therefore raised a question that goes beyond the security of refrigeration equipment. As more essential services depend on internet-connected machines, weaknesses in systems that were once considered routine maintenance issues can become entry points for cyberattacks. The challenge is ensuring that the equipment keeping buildings, hospitals, warehouses and businesses operating receives the same security attention as the computers and networks connected to it.
