From supermarket freezers to blood banks: the cold chain as a target

A warning, and the target named in advance

On 21 October, before the Senate foreign affairs committee, the head of ANSSI (Agence nationale de la sécurité des systèmes d'information), France's national cybersecurity agency, returned to the wave of attacks that had just hit refrigeration systems at hundreds of French supermarkets. Vincent Strubel was precise about the causes, "basic security gaps," citing equipment exposed directly to the internet and weak passwords. He was equally precise about what worried him next, naming the sector he expected to be hit: "healthcare, from research laboratories to pharmacies storing vaccines"¹.

The day before, the security vendor Forescout had published a count of how exposed this equipment is worldwide, and had likewise flagged hospital cold storage among the uses at risk².

Eleven days later, overnight on 1 to 2 November, temperature setpoints were altered on refrigeration equipment operated by a contractor to the Établissement français du sang (EFS), France's national blood service³.

What CERT-FR confirms, and what it does not say

Alert CERTFR-2026-ALE-012 was published on 12 October, the day after the night during which several hundred stores lost control of their installations. It was updated on 13 October to add Copeland xweb and Dixell xweb supervisors to the Danfoss AK-SM and AK-SC series originally covered, then again on 16 October⁴.

The sectors the alert lists reach well beyond grocery retail: cold storage, food and beverage processing, pharmaceutical and chemical storage, and cold rooms inside plants, terminals and ports⁵.

What the document leaves out deserves equal attention. CERT-FR (France's governmental computer emergency response team) names no attacker, identifies no vulnerability and cites no CVE (Common Vulnerabilities and Exposures) identifier⁶. Three flaws affecting the Danfoss AK-SM8xxA platform were published in 2025, but nothing in the available material establishes that they were the entry path in October 2026, and Strubel dismissed third-party analyses making that claim before the senators.

The absence of an identifier does not mean no flaw was exploited. Richard Horne, head of the UK's NCSC (National Cyber Security Centre), said vulnerable technology had been exploited in several cases⁷. It means nobody has publicly established which one. What I take from this is the practical consequence: while the entry path remains unknown, applying a patch guarantees nothing, and exposure is what has to be dealt with first.

How a refrigeration controller becomes reachable

A refrigeration supervisor drives temperature setpoints and defrost cycles across a set of units. It is administered through a web interface, and day-to-day use generally falls to an outside maintenance contractor.

That remote-maintenance need explains most of it. The interface ends up reachable from the internet, through a public IP address, a port forward on the site's router, or a cellular router. Coop in Sweden said the affected equipment was connected over older 4G mobile networks⁷.

The scale is measurable. In October 2026, Forescout recorded 12,976 observations of refrigeration control services reachable from the internet, tied to 6,017 distinct public IP addresses, across 99 countries and territories. Copeland and Dixell XWEB supervisors account for 7,075 of them, Danfoss StoreView for 4,697. Of the 513 Carel pCOWeb services observed, 226 returned no authentication challenge at all².

The accounts Danfoss gave Belgian and Dutch media converge with the French agency's finding: unpatched software, systems outside any secure network, unchanged default passwords⁸. In France, most affected units were older models, the AK-SM 800 and AK-SC 355, which the manufacturer no longer updates.

The observed effects involve diverted function more than destruction. In Belgium, units were switched into permanent defrost mode, warming instead of cooling. Elsewhere setpoints were raised: 50°C in a Swedish store, 50°C on an Estonian freezer whose internal temperature rose only two or three degrees before being corrected within about ten minutes. A Belgian butcher reported units at 18°C and some fifteen thousand euros of spoiled meat.

That gap between the displayed setpoint and the temperature actually reached strikes me as the thing media coverage handles worst, and it matters for what follows.

From the frozen aisle to the plasma bag

The incident involving the blood service was revealed on 3 November by Le Canard enchaîné. The equipment concerned is operated by Coolworld, the establishment's refrigeration contractor, not by the EFS itself. According to the paper, units held at around −30°C had their setpoint raised to 110°C, with installations in Bourgogne-Franche-Comté among the sites affected. An on-call technician spotted the abnormal rise overnight and intervened; the sources do not say what alerted him³.

The establishment first described donor samples kept for health surveillance, then told the paper that frozen plasma intended for transfusion was also involved. The Health Ministry states that the incident had no operational consequences, the anomalies having been detected in time.

French regulation gives the order of magnitude. The decision of 3 June 2025 setting out the list and characteristics of labile blood products requires that plasma be frozen "by rapid cooling to −30°C or a lower temperature"⁹. The text describes a freezing process rather than a storage threshold, but it puts the −30°C setpoint reported on the affected installations in context.

Several things remain unknown, and I would rather say so than fill the gap. The number of installations affected, the duration of the disruption and the temperatures actually reached inside the units or in the bags have not been made public. No plasma destruction, compromised transfusion or patient harm is confirmed, nor any theft of donor data. Nothing public establishes either that Coolworld's equipment belongs to the controller families named in the CERT-FR alert, or that the same actors are responsible.

One fact survives all those reservations: a remotely adjustable parameter here determines whether a medical product remains fit for use.

A campaign that spills across borders

Overnight on 1 to 2 November, incidents multiplied outside France. At least eleven countries are involved, the United Kingdom among them: Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, Finland, Portugal, Italy, Germany and Romania⁷.

The volumes stay modest relative to the estates concerned. Carrefour Belgium reports around fifteen stores out of more than seven hundred, Coop in Sweden six or seven out of roughly eight hundred, Musgrave in Ireland thirteen SuperValu stores out of two hundred and twenty-three, Italy around twenty outlets, Romania six, Germany four. The Italian government judged the impact "highly limited" and confined to outlets whose security was not up to date.

Attribution remains open, and authorities differ on how to read it. Belgium's federal prosecutor has opened an investigation. The Belgian Centre for Cybersecurity has said the perpetrators' identity may never be established. Romania's cybersecurity chief, Dan Cimpean, called the attack "semi-amateurish" and said he does not suspect a state actor. The European agriculture commissioner, Christophe Hansen, for his part called it "a deliberate attempt to disrupt our food supply chain." No one has claimed responsibility.

Before the senators, Strubel mentioned, regarding the general threat rather than this campaign specifically, "young French people we have already seen at work against the State," motivated by reputation rather than money. He was describing a profile, not making an attribution.

What CERT-FR recommends

The recommendations come down to a few points, and their wording repays attention⁵.

For equipment that has not been compromised: remove its exposure to the internet, check the entire configuration including defrost ranges, restore access only through a virtual private network or protected network, then apply the manufacturer's hardening guidance. For Danfoss, that means updating the firmware, setting the security level to strict and changing default passwords.

For compromised equipment, the sequence adds a reboot or factory reset, followed by a full reconfiguration.

The most useful point concerns end-of-life hardware. The alert warns that a factory reset does not protect it, because it cannot be patched, and that it will be compromised again if it stays exposed. Replacement is the practical consequence of that warning, and it is the category most of the equipment hit in October belonged to.

One final recommendation, easy to miss, says a great deal about conditions on the ground: before cutting a contractor's data feed, check the terms of the insurance contract. Filtering the contractor's source IP addresses is accepted only as a stopgap. Hardening here runs into contractual maintenance commitments, which explains part of the inertia observed.

What this sequence makes visible

The information travelled. The alert went out the day after the events, it was widened twice in four days, an independent count of worldwide exposure was published on 22 October, the head of the agency named before the Senate the sector he feared would be hit next, and ANSSI said it was working on the matter with CERT Santé and the Health Ministry.

That did not prevent the incident. I hesitate, even so, to conclude that transmission failed, because we do not know whether the blood service's contractor was aware of the alert, whether it had started any work, or exactly which equipment was affected. What the sequence does establish is more modest and already useful: a national recommendation, even public, precise and repeated, is not on its own enough to secure every piece of equipment concerned. The open question is how security requirements reach contractors, how they are checked, and how they are applied on the ground.

That is what the supply chain security obligations in the NIS2 directive address, and France has yet to transpose them. Nothing suggests that a framework in force would have prevented this incident. I do think it would have given a hospital operator a contractual basis for demanding from its contractor the inventory nobody asks for today.

For any organisation storing temperature-sensitive products, the question to ask this week is not about a patch. It fits in three lines: which refrigeration equipment is driven by a supervisor, who reaches it remotely and by what route, and does that supervisor answer a request coming from the internet. The 12,976 services counted by Forescout suggest where the most common answer lies.

Sources & notes

1. Public Sénat, "Des défauts de sécurisation élémentaire et des mots de passe faibles ont permis la cyberattaque contre les frigos de supermarchés", 21 October 2026 (in French), https://www.publicsenat.fr/actualites/politique/des-defauts-de-securisation-elementaire-et-des-mots-de-passe-faibles-ont-permis-la-cyberattaque-contre-les-frigos-de-supermarches ↩

2. Forescout, "Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk", 22 October 2026, https://www.forescout.com/blog/cold-chain-open-control-exposed-refrigeration-systems-reveal-global-risk/ ↩ ↩²

3. Cyberattaque.org, "Cyberattaque contre l'EFS : des hackers s'attaquent aux réserves de plasma sanguin", 3 November 2026, relaying Le Canard enchaîné (in French), https://www.cyberattaque.org/cyberattaque-contre-lefs-des-hackers-sattaquent-aux-reserves-de-plasma-sanguin/ ↩ ↩²

4. CERT-FR, alert CERTFR-2026-ALE-012, published 12 October 2026, updated 13 and 16 October 2026 (in French), https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/ ↩

5. Red Tiger Security, "CERT-FR Warns of Active Campaign Against Internet-Exposed Refrigeration Controllers", https://www.redtigersecurity.com/advisory/certfr-refrigeration-controllers-campaign ↩ ↩²

6. The Hack Academy, "What CERT-FR's refrigeration alert does and does not confirm", 13 October 2026, https://www.thehackacademy.com/cert-fr-refrigeration-controller-compromises.htm ↩

7. Euronews, "Italy holds emergency talks as supermarket fridge attacks spread across Europe", 3 November 2026, https://www.euronews.com/2026/11/03/italy-holds-emergency-talks-as-supermarket-fridge-attacks-spread-across-europe ↩ ↩² ↩³

8. The Hacker News, "New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food", 3 November 2026, https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html ↩

9. Décision du 3 juin 2025 fixant la liste et les caractéristiques des produits sanguins labiles, Légifrance (in French), https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000051724997 ↩