Cybersecurity researchers have uncovered evidence of suspicious activity targeting internet-connected refrigeration systems across Europe in the days before a series of incidents disrupted supermarkets and blood banks, raising concerns about the security of critical infrastructure.
Refrigeration systems in supermarkets across nine European countries and several blood banks in France were affected on November 2 and 3. Hackers exploited weak passwords and vulnerabilities in Danfoss AK-SM refrigeration system managers to switch fridges and freezers into defrost mode. In some cases, temperatures reportedly reached 50 degrees Celsius, forcing retailers to dispose of spoiled food.
Cybersecurity firm Lupovis said it detected a wave of reconnaissance activity targeting the systems between October 20 and 30. Its sensors recorded more than 276 attempts from 91 different threat actors seeking access to specific components of Danfoss controllers. Activity peaked on October 26 before stopping towards the end of the month.
Lupovis chief executive Xavier Bellekens said the activity suggested attackers had been testing default passwords and known vulnerabilities before the incidents.
The company uses monitoring systems known as honeypots, which imitate real online infrastructure and attract attempted attacks. This allows researchers to identify threats without exposing customers’ actual systems.
Possible links to state-backed activity
Lupovis traced some of the digital activity to bulletproof hosting services, which are designed to resist takedown requests and law enforcement intervention. Some of the providers had previously been used by Russian cybercrime groups.
Bellekens cautioned that the location or history of a hosting provider did not establish the nationality of those responsible. However, he said the coordinated timing and concentration of activity in Europe suggested a well-organised operation that could involve a state actor.
He said Lupovis had not detected comparable activity through its sensors in South America, Africa, North America or Asia.
The identity and motivation of the attackers remain unknown. George Nott, technology editor at The Grocer, said the systems had been accessed through basic security weaknesses, including exposed login pages, weak passwords and vulnerabilities for which fixes were already available.
He warned that the absence of a ransom demand or claim of responsibility made it difficult to determine whether the operation involved a state-backed group or ordinary cybercriminals.
Wider risks to hospitals and data centres
Experts say the incidents highlight weaknesses that could affect other connected equipment, including heating, ventilation, security cameras, electronic access systems and industrial controls.
Kumar Sokka, chief executive of Acre Security, said the same type of internet-connected controllers used in refrigeration systems also operate doors, alarms, cameras and other building infrastructure.
A successful intrusion into a hospital or data centre could disable security systems or interfere with essential operations without producing obvious signs of damage.
Sokka said organisations often treat building equipment as a maintenance responsibility rather than part of their cybersecurity operations, despite requirements under the EU’s NIS2 Directive to protect networked systems.
AI could accelerate future attacks
Cybersecurity specialists also warned that artificial intelligence could shorten the time needed to identify vulnerabilities and develop attacks.
Gianni Cuozzo, founder and chief executive of Italian cybersecurity firm Exein, said connected devices needed stronger protection against malicious activity, rather than relying solely on software updates and network security.
He identified refrigeration, healthcare, industrial equipment, data centres and energy infrastructure as areas requiring greater attention.
The incidents have prompted renewed questions about whether organisations are adequately protecting the connected systems that keep essential services running.
