Fridge cyberattack hits 13 countries and France's blood service

Updated 4 November, 02:51 UTC. Cold rooms that a contractor runs for France's blood service, EFS, were also tampered with that night; the health ministry says the incident was caught in time.

Refrigeration systems at shops and food businesses in at least 13 European countries failed or were tampered with overnight into Monday, including cold rooms used by France's national blood service. Supermarkets in Portugal, Italy, Romania and Germany reported cases later on Monday, after Sweden, Belgium, Luxembourg, the Netherlands, Finland, Ireland and Estonia, and on Tuesday the UK's cyber agency confirmed cases in Britain. Danfoss, which makes many of the controllers, confirmed that the incidents involve its products, DR reported.

Romania's national cyber security directorate, DNSC, gave the first official technical account: the controllers in six stores of one chain were connected through GSM routers with fixed IP addresses, directly reachable from the internet, and ran fairly old software, its director, Dan Cîmpean, said, as quoted by G4Media. In the Netherlands, a Danfoss spokesperson said the attacked systems were not on a secured network and used a default password, NOS reported.

Romania's DNSC is treating its case as a possible cyberattack and Belgian prosecutors are investigating; no authority has said who is behind the incidents, and no group has claimed them.

GeoInsider, an account on X, has tracked the incidents country by country since early Monday.

What the authorities say

Belgium's federal prosecutor's office has opened an investigation, a spokesperson said, and the country's Centre for Cybersecurity said it was aware of an incident targeting supermarket refrigeration, according to Euronews. A Danfoss spokesperson said the vulnerability "lies primarily in outdated software" and that customers who had not updated their software were affected.

Portugal: seven Intermarché stores

Grupo Mosqueteiros, which runs Intermarché in Portugal, said incidents linked to a cyberattack were found at seven of its stores, and that the attack appears to have targeted an outside company that manages their refrigeration systems, RTP reported. The group said its supply chain was not affected and food safety was assured.

Italy and Germany

The Radenza group, which runs Coop-branded stores in Sicily, said hackers changed the temperature settings at at least three stores in Catania and one in Palermo, ANSA reported.

In Germany, an Edeka store in Reisbach, Bavaria, said on Facebook that hackers had heated its cooling systems to up to 50°C and that large amounts of food had to be thrown away, and a CAP-Markt in Wuppertal blamed an external intervention and filed a police complaint, t-online reported.

Belgium, Luxembourg and the Netherlands

Delhaize confirmed an "IT incident" at about 40 Belgian stores, with fridges and freezers reaching about 15°C, and a spokesperson told NOS that Luxembourg stores were hit too. Carrefour Belgium reported 15 affected stores, and the Belgian count reached about 75 stores, including 15 Intermarché and five Spar shops, Euronews reported. Sabcobel, a Belgian company that makes some of the affected refrigerators, said their evaporators had been switched to defrost mode, which warms the units, the BBC reported.

In the Netherlands, the cooling systems of at least 17 businesses, mostly butchers and small stores, were attacked, Danfoss said. It had told Dutch customers on October 13 to take the systems off the internet; a small number did not.

Sweden, Ireland, Estonia and Finland

SVT reported affected ICA stores in Skåne and on Öland, and Coop said six of its stores in central Sweden had similar problems. Musgrave removed chilled and frozen food from sale at 13 SuperValu stores in Ireland and said the incident was "limited to a specific model of refrigeration equipment", The Journal reported. In Estonia, a refrigeration supplier said attackers raised an older Danfoss system at a Selver store to 50°C, ERR reported, and in Finland, Kesko told Yle that a few smaller K stores had faults it could not yet explain.

United Kingdom

The UK's National Cyber Security Centre is aware of "a couple of instances where vulnerable technology had been exploited in the UK", and its chief executive, Richard Horne, said it had worked through the night to alert potentially affected organisations, the BBC reported. The Association of Independent Meat Suppliers said some of its more than 300 members had become "collateral", though none lost any meat. Horne said it was "too early to say" who was behind the attacks.

France: the blood service

The same night, attackers changed the settings of cold rooms that the refrigeration contractor Coolworld runs for France's national blood service, EFS, the weekly Le Canard enchaîné reported: units meant to keep donor blood samples at -30°C were set to 110°C, and an on-call technician noticed temperatures rising overnight. The 110°C figure is the setting the attackers entered; nobody has said how warm the rooms became. France's health ministry said the incident had no operational consequences because it was detected in time, according to Anadolu.

CERT-FR warned on 12 October of numerous compromises of remote controllers for refrigeration systems, naming Danfoss AK-SM and AK-SC and Copeland and Dixell xweb, and told operators to take their management interfaces off the internet. Neither EFS nor Coolworld has said which controllers the blood service uses.

The October attack in France

On the night of October 11, threat actors took remote control of refrigeration controllers at hundreds of French supermarkets and forced defrost cycles, franceinfo reported. France's cyber agency, ANSSI, said the attack used no published vulnerabilities but "basic security defects": equipment exposed directly to the internet and weak passwords. Danfoss, Sabcobel and an Estonian supplier have compared Monday's incidents with that attack.