Hackers scanned Europe's refrigeration systems in advance before attacks on supermarkets and blood banks

What happened

On 2 and 3 November, refrigeration systems in supermarkets across nine European countries were attacked, as well as several blood banks in France. The attackers exploited weak protection and vulnerabilities in the AK-SM refrigeration system manager made by Danfoss: fridges and freezers were switched into defrost mode, and in some cases the temperature rose to 50 degrees Celsius. Stores had to throw away spoiled products. According to Euronews, access was often gained through login pages exposed to the open internet, using already patched vulnerabilities and factory passwords such as 'Supervisor' and '12345'.

Reconnaissance before the attack and theories about the perpetrators

Lupovis, a company that operates a network of honeypots, reports that between 20 and 30 October it recorded a wave of reconnaissance: more than 276 attempts from 91 attackers, matching the components of Danfoss controllers, with a peak on 26 October. The company's sensors in South America, Africa, North America and Asia recorded no similar activity — only in Europe. The company's CEO, Xavier Bellekens, points to the use of bulletproof hosting previously employed by Russian groups, and to the ability to coordinate an attack within 24 hours: in his words, it 'looks like a well-planned operation' and 'could well be Russia'. At the same time, the company itself stresses that the location of servers does not indicate the nationality of the users. The Grocer's technology editor, George Nott, warns against jumping to conclusions: without a ransom demand or a claim of responsibility, the perpetrators 'could be anyone — from a state-sponsored actor to a group of teenagers doing it for fun'.

Assessments of the incident differ

National cybersecurity agencies described the events differently: Belgium, Luxembourg, Italy, Portugal and Estonia called it a 'cyberattack', while Sweden and Ireland called it a 'cyber incident'. The EU cybersecurity agency ENISA, in a joint statement, also refrained from directly calling the incidents a cyberattack.

Why the systems remained vulnerable and what comes next

In Bellekens' view, many systems could have been protected by placing them behind a VPN instead of connecting them directly to the internet. Experts point out that the risk extends beyond retail: the same small connected controllers control doors, cameras, alarms and ventilation in buildings, as well as logistics, healthcare and data centre systems. Kumar Sokka, CEO of Acre Security, believes the problem is not a lack of regulation — the EU's NIS2 directive already requires managing such risks — but that organisations confine its application to classic IT systems, leaving building equipment to facilities teams. Gianni Cuzzo, founder of Exein, warns that AI is shortening the time between the discovery of a vulnerability and the creation of a working attack, and calls for devices to be able to block behaviour unusual for them on their own, rather than relying solely on updates.