European refrigeration cyberattacks spread from supermarkets to French blood storage

The attacks turn a routine business system into a way to destroy stock. By accessing refrigeration controls remotely, hackers can change the settings that keep food safe. Forbes reported that anonymous attackers had ruined millions of dollars of frozen supermarket goods by accessing temperature controllers.

The reported incidents began with supermarket refrigeration in France in mid-October, followed by attacks in numerous other European countries in early November, according to Le Monde. The damage was physical: retailers had to throw food away, not simply restore computer systems.

On Monday, November 2, attackers targeted three cold-storage sites belonging to the French Blood Establishment, or EFS. Temperature and defrosting thresholds were raised to extremely high levels, the organization said, according to Technology.

The route into those systems matters. The Register reported that attackers tampered with the blood service's cold-storage settings after compromising a refrigeration supplier. BleepingComputer also reported that the attack targeted a refrigeration equipment provider.

Alarms caught the changes before plasma or samples were lost, The Next Web reported on November 4. Officials said no samples were compromised, according to Euronews. Reports about extreme temperature settings should therefore not be read as evidence that stored blood actually reached those temperatures.

Also on November 4, DIE WELT reported that hackers had remotely manipulated a butcher's cold rooms in Bavaria's Upper Palatinate, causing them to heat to as much as 150 degrees. Its report said similar attacks had forced food disposal elsewhere in Germany.

On November 5, TechCrunch reported a joint US government statement warning of an ongoing cyber threat affecting the food, transportation and healthcare industries. That warning broadened the concern beyond European supermarket losses.

The French blood-storage attack was thwarted before blood products or samples were damaged, according to French authorities cited by KYTV. That distinguishes it from the supermarket incidents, where food was destroyed.

A shared target does not yet establish a shared attacker. Le Monde reported that it remained unknown whether the blood-service incident was connected to the earlier attacks on supermarket refrigeration.

On November 5, Russia denied involvement, RTBF reported, citing Kremlin spokesman Dmitri Peskov. That denial does not resolve who carried out the attacks.

The immediate question is whether other operators can identify and secure exposed refrigeration controls before further losses occur. Kevin Curran, Professor of Cybersecurity at the University of Ulster, described the supermarket attack as not sophisticated and said the vulnerabilities had long been known, according to Euronews.

Investigators still need to establish whether the incidents are linked and who is responsible. The supplier compromise reported by The Register also makes the security of refrigeration providers a concrete issue, alongside the defenses of individual shops and medical facilities.