European Supermarket Fridge Hacks Raise Alarm After French Blood Storage Attack

The attacks targeted equipment supermarkets depend on to keep food safe: connected fridges and freezers. Attackers remotely changed refrigeration controls, leaving retailers with spoiled stock and damage running into the millions, according to Associated Press.

The method exploits equipment designed to do more than cool. Scientific American reported that attackers hijacked built-in defrost controls, turning freezers into heaters. DIE WELT reported that old, unsecured technology was being exploited.

The reported incidents stretch back into October. Le Monde described attacks on French supermarket refrigeration in mid-October, before further incidents across numerous European countries in early November.

By November 3, German supermarkets were also affected, according to DIE WELT. Retailers there had to throw away food, n-tv.de subsequently reported.

Italy held emergency talks as the attacks spread, Euronews reported on November 3. The outlet said the European Union regarded the attacks as a deliberate attempt to disrupt the food supply chain, while Romania's cyber chief described them as "semi-amateurish".

On November 4, Al Jazeera reported attacks in at least 11 countries, with Germany, Romania and the UK among those reporting incidents. The EU said they were not isolated.

That same day, reporting revealed an attack on three French blood storage sites. The Register reported that attackers had compromised a refrigeration supplier before tampering with cold-storage settings used by the French Blood Establishment, or EFS. The Next Web reported that alarms caught the changes before plasma or samples were lost.

The French blood storage incident did not compromise samples, officials told Euronews. Reports describing settings as high as 110°C concern what attackers programmed, not proof that stored blood products reached that temperature, according to the account of reprogrammed controls in The Hindu.

Responsibility remains unresolved. Al Jazeera reported that a Romanian official suspected no state actor. Nor is a connection between the blood storage incident and the supermarket attacks established: Le Monde explicitly reported that the link remained unknown.

Two central questions remain: who accessed these systems, and whether the incidents share an attacker or a route into refrigeration controls. The supplier compromise reported by The Register is a specific part of that investigation, not evidence that every affected supermarket was breached the same way.

The concern extends beyond groceries. Dark Reading reported that internet connectivity, remote access and inadequate security can expose temperature-controlled infrastructure in other critical sectors. The French incident shows why detection matters: alarms prevented an attempted disruption from becoming a loss of medical supplies.