Hackers disable European freezers holding blood and food, raise temperatures in coordinated attack

Blood banks and supermarkets lose cooling in coordinated strike

French blood banks and European supermarkets lost cooling on Monday after hackers sent temperatures climbing in their refrigeration units. The French Blood Establishment (EFS) said the attack breached cold-storage rooms at three of its sites, placing frozen plasma—used for transfusions and drug manufacturing—under threat. Workers transferred supplies to secure locations before any products spoiled.

Hundreds of grocery stores in France, Belgium, Sweden, and Finland experienced the same assault. Shelves emptied as food warmed, though no retailer has released a full tally of losses.

Weak security in refrigeration controllers made attacks possible

The hackers homed in on industrial controllers, especially those made by Danfoss. These devices had known security holes and public internet addresses, making them easy targets. Cybersecurity teams at Previdian, Lupovis, and Sekoia built fake systems—called honeypots—to lure the attackers and map their methods. The honeypots revealed selective probing: only European sites were hit, and the disruptions were timed for overnight to cause maximum spoilage.

Ryan Dewhurst, a cybersecurity expert at Previdian, told the BBC the attackers must have compiled target lists and rehearsed the timeline. Lupovis founder Dr. Xavier Bellekens added that the entry points were so weak that ‘known attack methods were already circulating online.’

Russian and Iranian groups lead the list of suspects

Two Russian hacktivist groups, Noname057(16) and Z-Pentest Alliance, first took credit. They posted claims of hacking Danfoss on Telegram, only to remove the messages hours later. Chris Vallance, a BBC reporter covering technology, noted that both groups normally specialize in DDoS attacks, not the sophisticated sabotage seen here.

Suspicions still point toward Moscow or Tehran. Sekoia’s report drew parallels with a 2022 attack on forty Israeli supermarkets, and a separate strike on six US military bases in August. Bellekens told the BBC that Iranian-linked groups have repeatedly gone after exposed industrial controls in countries they see as adversaries. Formal attribution is still pending; authorities in France, Belgium, Sweden, and Finland continue their investigations.

French authorities lock down breach, operators scramble to secure systems

The French Blood Establishment worked with ANSSI, the national cybersecurity agency, and the Ministry of Health to seal the breach. Within hours, the EFS declared the situation under control and ramped up monitoring of its refrigeration units.

Yet the attacks demonstrated how third-party-managed freezers can slip through security nets. Owners of hospitals, labs, and grocery chains are now rushing to review every internet-connected controller—especially those holding temperature-sensitive goods.

Unpatched controllers still at risk, AI threat tools accelerate investigations

Danfoss released patches last year for the very flaws exploited in Monday’s attacks. Still, unpatched devices kept appearing in new breaches—a pattern that shows industrial hardware remains at risk when users postpone updates.

While artificial intelligence played no role in these attacks, cybersecurity firms are already deploying AI-powered honeypots to flag suspicious patterns faster. Startups like Trajectory and Serval, backed by Sequoia, are pushing this approach to shrink the time between detection and attribution.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

Hospitals and supermarkets discovered that an internet-connected freezer is no longer just an appliance—it’s a potential entry point for attackers. Owners must now treat every temperature sensor and controller as part of their security perimeter, patching them as urgently as they patch laptops.

Key takeaways

• French blood banks avoided losses, but the attack spotlighted how third-party-managed freezers can become single points of failure across sectors.
• Danfoss issued fixes a year ago, yet unpatched controllers kept attracting attackers; manufacturers need automatic, not optional, updates.
• Honeypots run by Previdian, Lupovis and Sekoia quickly trapped the attackers, showing that automated deception networks are now essential for fast attribution.

Related on Lazyfounder

• Danfoss
• Critical flaws in Danfoss refrigeration controllers expose thousands to remote attacks