Hacking of Cooling Systems Hits French Blood Banks and European Stores, Sparking Fears for Critical Infrastructure

The first days of November witnessed a worrying cyber incident that touched the daily lives of residents and citizens in France and several European countries, after internet-connected cooling systems in nine nations suffered coordinated attacks on November 2 and 3, impacting food distribution chains and several blood banks on French soil.

Organized Cyber Reconnaissance Preceded the Attack

Cybersecurity researchers confirmed that hackers conducted scanning and reconnaissance of internet-connected systems prior to the attacks. Lupovis, a digital security firm, detected more than 276 attempts from 91 malicious actors targeting components specific to Danfoss control systems between October 20 and 30, peaking on October 26 before ceasing by the end of the month.

Xavier Bellekens, CEO of Lupovis, explained that his team observed a sudden surge over a ten-day period testing default passwords and scanning for vulnerabilities, describing the activity as "akin to burglars walking around a neighborhood to identify target homes to break into." These movements were monitored through digital honeypots mimicking systems of the company's clients, such as the Scottish Government, Orange, Telefónica, and retail enterprises.

Spoiled Food and Disruption of Critical Facilities

The hackers exploited weak protection measures and vulnerabilities in Danfoss-manufactured "AK-SM" refrigeration management units, activating defrost functions and setting temperatures to surge in some cases up to 50°C. This action forced several food stores to destroy and dispose of significant quantities of spoiled food, and sounded alarm bells after impacting French blood banks that require precise, critical cooling temperatures.

Commenting on the attack method, George Nott, technology editor at The Grocer magazine, explained that the operation did not require highly sophisticated techniques; rather, it relied on locating publicly accessible login pages on the internet, exploiting legacy vulnerabilities, and using factory default credentials like the username "Supervisor" and password "12345", amid widespread neglect of connected device security within the retail sector.

Fingers Pointed and Fears of Broader Infrastructure Targeting

Digital analyses showed that the attackers utilized bulletproof hosting services that do not comply with law enforcement requests—infrastructure previously used by Russian groups. While Lupovis stressed that it is difficult to determine the actual nationality of the attackers, Bellekens noted that the scale of the attacks, their coordination within a 24-hour window, and their geographical confinement to Europe suggest the involvement of an organized, state-sponsored entity.

Official characterizations varied across European capitals; Belgium, Luxembourg, Italy, Portugal, and Estonia classified the event as a "cyberattack," whereas the European Union—through its agency ENISA—along with Sweden and Ireland, preferred to describe it as a "cyber incident" in the absence of financial ransom demands or claims of responsibility.

Experts, including Kumar Sooka, Managing Director at Acre Security, and Gianni Cuozzo, CEO of Exein, warned that the danger could extend beyond cooling to encompass control gates, ventilation, and lighting in hospitals, data centers, and logistics hubs. They stressed the necessity of enforcing the European "NIS2" directive and obligating facilities to protect internet-connected physical equipment, rather than leaving it exposed to direct breaches without Virtual Private Networks (VPNs).