Until this week, the wave of refrigeration cyberattacks sweeping Europe looked like a supermarket problem. That changed when France's national blood service confirmed that temperature controls had been altered at three of its sites. Blood products stored for hospitals were suddenly at risk, and the attackers had not even targeted the organisation directly.
The Établissement Français du Sang (EFS) said "temperature and defrosting thresholds were raised to very high levels" in its cold storage
Until this week, the wave of refrigeration cyberattacks sweeping Europe looked like a supermarket problem. That changed when France's national blood service confirmed that temperature controls had been altered at three of its sites. Blood products stored for hospitals were suddenly at risk, and the attackers had not even targeted the organisation directly.
The Établissement Français du Sang (EFS) said "temperature and defrosting thresholds were raised to very high levels" in its cold storage rooms. These rooms hold blood products at preparation and distribution sites before they go to healthcare facilities, along with samples for biobanks.
The outcome was far better than in the supermarkets. "No health impacts have been identified and no losses of blood products have been reported," the EFS said in a statement on Tuesday.
How the Refrigeration Cyberattacks Reached Blood Storage
The EFS says it was not targeted directly. Like many of the affected retailers, it says the attack reached it through a third-party provider of refrigeration equipment.
That detail explains why a blood service ended up on the same list as supermarkets. If attackers can get into a shared supplier's systems, any organisation using that equipment may be exposed, whatever its sector.
This is the first reported case in France in the second wave of attacks on control systems, and the first reported to affect a healthcare organisation.
Why the Blood Supply Survived When Food Did Not
The difference came down to how quickly someone noticed. "The EFS's monitoring and alarm systems enabled the rapid identification of these anomalies and the implementation of necessary measures to ensure that no blood samples or products were compromised," the organisation said.
Depending on the situation, affected equipment was either brought under control without impacting the products, or shut down. Products in the affected cold rooms were moved to other facilities as a precaution.
Compare that with the first wave in France in October. Attackers remotely defrosted fridges in hundreds of supermarkets, reportedly by triggering a forced defrost option, and pushed temperatures as high as 50 degrees Celsius. They struck while stores were closed, so the heat went unnoticed for hours. Tonnes of food perished, some equipment melted, and in some stores the heat sparked fires. Reporting on that wave found the attackers had targeted ageing, internet-connected devices still online years after their manufacturer stopped supporting them.
How Far the Refrigeration Cyberattacks Have Spread
The second wave is wider than the first. Businesses in at least 11 countries have reportedly been affected: Belgium, Estonia, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, Portugal, Sweden and the United Kingdom.
Earlier this week, supermarket chains in Sweden, Belgium, Luxembourg, Ireland and Estonia reported fridges and freezers set to high temperatures, with several discarding food. In Estonia, where the intrusion was caught within minutes, there was no significant damage.
Who Is Behind It?
No one knows for sure, and no group or entity has claimed responsibility for the attacks. It is also unclear whether the same people are behind both waves.
Rumours have spread online that two Russian hacktivists groups, Noname057(16) and Z-Pentest Alliance, posted that they had hacked Danfoss. That led to speculation that they were behind the freezer attacks. Analysts now question whether that claim means they were responsible.
Russian groups have not been ruled out. However, experts say Iranian hacktivists, nation-state hackers, or even teenagers pulling pranks could also be the culprits.
A French Bank Reports a Separate Attack
In the same week, Crédit Mutuel Arkéa in northwestern France said it had halted some services after a cyberattack enabled fraudulent transactions. Nothing in the bank's statements links the incident to the refrigeration attacks. However, the bank describes a similar entry point: attackers "used the platform of one of our service providers" to reach the bank directly.
The bank said attackers used its own account, not customer accounts, to make transactions to other banks. That potentially let them convert the money into cryptocurrency through specialised platforms. It denied press reports that the attackers got in through its subsidiary Fortuneo, and said human error was not the cause.
Asked whether 118 million euros was stolen, the bank said it could not confirm the figure and could "only validate the order of magnitude." Some funds have been frozen and recovery efforts are under way. The bank says the losses will not threaten its financial stability and that customers' assets were not affected, apart from delays to some transfers. Almost all operations have resumed.
The bank has also warned customers about a likely rise in phishing attempts, urging them never to share passwords, card numbers or SMS validation codes.
The refrigeration attacks and the bank attack have not been tied to the same attackers. What they share is the route in. In both cases, the organisations say they were reached through an outside provider rather than through their own systems. Neither the blood service nor the bank was the first door the attackers opened.
A massive French supermarket cyberattack targeted Danfoss refrigeration systems, causing catastrophic food spoilage and fires across 400 retail locations.
Related Posts:
Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower
Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK
UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers
The post Massive Cyberattack Paralyzes French Supe
A massive French supermarket cyberattack targeted Danfoss refrigeration systems, causing catastrophic food spoilage and fires across 400 retail locations.
Hackers hit French supermarkets via unpatched Danfoss refrigeration systems, remote-heating freezers and destroying stock worth millions.
Overnight from Sunday to Monday, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed. The attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires.
The method is
Hackers hit French supermarkets via unpatched Danfoss refrigeration systems, remote-heating freezers and destroying stock worth millions.
Overnight from Sunday to Monday, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed. The attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires.
The method is simple and nasty. Refrigeration systems have a forced defrost function that clears ice buildup, and the attackers appear to have triggered it remotely in a continuous mode, with a temperature setting of 50 degrees. The equipment heated for several hours instead of keeping goods cold, and when staff opened the fridges and freezers in the morning, a sector source told BFM, “a wave of heat” came out.
“300 Intermarché and Netto stores, and fewer than 100 U stores, were affected on Monday, October 12, by a cyberattack targeting the refrigeration control systems of the Danish manufacturer Danfoss, according to the two retailers.” reports BFMTV. “Hackers reportedly remotely altered the temperatures of the systems, causing the destruction of stocks of fresh and frozen products.”
The scale is still being counted. The Mousquetaires group says 300 of its Intermarché and Netto stores were affected, Coopérative U says fewer than a hundred of its outlets, and E.Leclerc confirmed repercussions on cooling equipment in several stores without giving numbers. A specialist site reported that Carrefour Market and Monoprix stores were hit too, which those chains haven’t confirmed.
The money follows. A sector source told BFM national losses could reach several million euros, and Intermarché said its affected stores had to throw out all the fresh and frozen products concerned. In Haguenau, an Intermarché reportedly lost its entire frozen stock, an estimated 50,000 euros, and a Leclerc store about 30 kilometers away in Wasselonne reportedly discarded frozen and fresh goods worth around 220,000 euros.
Danfoss stated that it is aware of the incidents in France, noting that they affected a limited number of refrigeration management systems. The company explained that most of the impacted equipment was older hardware—specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates—while the AK-SM800A units involved were running outdated firmware. Danfoss emphasized that it has long advised customers to keep supported systems updated and is actively collaborating with those affected.
Following the attacks, the Paris prosecutor launched an independent investigation into the cyberattack targeting connected refrigerators across major French food retailers. The anti-cybercrime unit is leading the inquiry, with the OFAC office responsible for counting victims and connecting them to the resulting damages, which include spoiled food and fires.
This incident follows a concerning precedent. On August 9, Claroty’s Team82 released research detailing vulnerabilities in Danfoss refrigeration controllers. Upon examining the AK-SM 800A, one of the models targeted in this week’s attack, the researchers discovered multiple flaws, including a hidden authentication mechanism that bypassed standard login protocols.
The full extent of the damage is still being calculated. The Mousquetaires group reported that 300 Intermarché and Netto stores were affected, while Coopérative U stated that fewer than 100 of its locations were hit. E.Leclerc also confirmed that cooling equipment in several stores was affected, though they did not provide specific figures. Meanwhile, a specialized news site reported that Carrefour Market and Monoprix stores were targeted as well, though these chains have not yet confirmed it.
The financial impact is heavy. Industry sources told BFM that national losses could reach several million euros, and Intermarché confirmed that all affected stores had to throw out their fresh and frozen inventory. For example, an Intermarché in Haguenau lost its entire frozen stock, estimated at 50,000 euros, while a Leclerc store about 30 kilometers away in Wasselonne had to discard around 220,000 euros worth of fresh and frozen goods.
The damage isn’t limited to the east. In the Loire-Atlantique, the huge Leclerc Atlantis in Saint-Herblain took all its frozen products off its Drive service indefinitely, and the Leclerc in Saint-Brevin-les-Pins wasn’t expected to reopen its fresh aisle normally before Tuesday, October 13. Several U stores were hit as well, some only in the frozen aisle, and an Intermarché in the same area too. One photo from BFM shows an ice cream shelf reading 26 degrees, which is a fine temperature for a beach.
Dominique Schelcher, the CEO of Coopérative U, said on X that attacking equipment essential to preserving fresh food and feeding French shoppers is extremely serious and unprecedented. His point is easy to see. Nobody was stealing data here, and the target was food.
Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau @CooperativeU. Nos équipes sont pleinement mobilisées, en lien avec les frigoristes, pour rétablir la situation au plus vite. Une enquête devra…
The authorities moved quickly. According to the Prime Minister’s office, the national cybersecurity agency ANSSI has identified a vulnerability in software supplied by Danfoss and contacted the company. ANSSI is also talking to its European counterparts because other countries may be affected, and it’s trying to find other French companies hit.
Danfoss stated that it is aware of the incidents in France, noting that they affected a limited number of refrigeration management systems. The company explained that most of the impacted equipment was older hardware, specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates, while the AK-SM800A units involved were running outdated firmware. Danfoss emphasized that it has long advised customers to keep supported systems updated and is actively collaborating with those affected.
Following the attacks, the Paris prosecutor launched an independent investigation into the cyberattack targeting connected refrigerators across major French food retailers. The anti-cybercrime unit is leading the inquiry, with the OFAC office responsible for counting victims and connecting them to the resulting damages, which include spoiled food and fires.
This incident follows a concerning precedent. On August 9, Claroty’s Team82 released research detailing vulnerabilities in Danfoss refrigeration controllers. Upon examining the AK-SM 800A, one of the models targeted in this week’s attack, the researchers discovered multiple flaws, including a hidden authentication mechanism that bypassed standard login protocols.
Because these controllers are typically managed remotely and feature a built-in web server, an attacker who gains access can send direct commands to the connected cooling systems—such as forcing a manual defrost. Claroty’s research highlights that the product is widely deployed across supermarkets, cold-storage facilities, and logistics warehouses, with a Censys scan revealing 2,765 exposed management interfaces online. Claroty disclosed these vulnerabilities to Danfoss, which subsequently patched them in firmware version R4.3.1.
However, BFM notes that authorities have not officially confirmed whether hackers exploited this specific flaw in the recent attack. If it was the entry point, standard security disclosure practices were followed, as details were withheld until a patch was made available. For legacy, end-of-life units, no security patches exist, leaving disconnecting them from the public internet as the only viable defense.
Below is my interview on the case with TRT World Now.
Entrar
