Over the past six months, a disturbing pattern has repeated itself: internet-connected commercial refrigerators have been hacked, temperatures have spiked uncontrollably, and perishable goods have been destroyed at scale. What began in the summer as a series of isolated incidents at US military bases has evolved into a coordinated wave targeting supermarkets across 11 European countries and, most recently, blood storage facilities in France. The attacks generated no financial profit — no data theft, no ransomware demands. Instead, they represented something more insidious: proof of power over the most mundane, and therefore most vulnerable, infrastructure of our time.
The second wave, which began in early November, hit major chains including Carrefour and Delhaí in Belgium, ICA and Coop in Sweden, and Edeka in Germany. More than 250 French supermarkets were affected in the October wave — Intermarché, Monoprix, Leclerc, and Super U all reported entire inventories being thrown away. In one Swedish store, the system actively generated heat, raising internal temperatures to 50°C. Three plasma storage sites operated by the Établissement Français du Sang (EFS), France's national blood service, were compromised on November 2; controllers had been programmed to reach 110°C, but rapid detection prevented the loss of blood products.
The common thread is clear: temperature controllers manufactured by Danish firm Danfoss, used across commercial refrigeration systems on the continent. According to France's CERT cybersecurity agency, the controllers were exposed directly to the public internet. Laurent Singier, an ethical hacker at Cyber 3 Lab, affiliated with Belgium's Howest University of Applied Sciences, found that many systems ran factory-default passwords that had never been changed — some derived from predictable dates. Attack surface mapping platform Censys counted more than 2,500 exposed Danfoss StoreView interfaces in France alone before the first wave; after Danfoss issued its warning, that number dropped to 220, yet approximately 1,000 remain visible on the public internet.
Danfoss issued a security bulletin on October 13, instructing customers to disconnect controllers from the internet and reconnect through private networks only. The bulletin appeared in October 2026 for the first time — no earlier version was found in searches — suggesting the manufacturer publicly acknowledged the vulnerability only after the initial attacks struck. The company did not respond to press requests for comment. Singier put it bluntly: "The weak point was basically putting these devices on the public internet. They shouldn't even be there."
What makes this incident particularly unsettling is that it is not a sophisticated attack. There is no evidence of zero-day exploits, no advanced malware, no state actor pulling the strings. The attackers exploited well-known vulnerabilities — two of them documented by the US CISA in 2025 (CVE-2025-41450 and CVE-2025-41451, affecting Danfoss AK-SM 8xxA controllers) — and weak passwords. What separates this case from thousands of poorly configured IoT incidents is scale and target: systems that control the temperature of products feeding millions of people and keeping alive patients who depend on transfusions.
Jon Abbott, CEO of cybersecurity firm ThreatAware, told The Observer the attack "doesn't carry the hallmarks of traditional cybercrime" — no ransom demands, no data encryption, no selection of targets based on financial value. "It's something more deliberate," he said. The motivation appears to be pure disruption: proving you can inflict physical chaos without needing sophisticated access. Ed Rowley, senior engineer at HackerOne, expanded the reasoning: "Anything connected to a home network — from a security camera to a smart thermostat — has the potential to be compromised. But in most cases, criminals aren't particularly interested in your fridge or heating system." Unless, of course, the objective is not to steal but to destroy.
The implications extend far beyond grocery stores. Cold-chain infrastructure is invisible critical infrastructure: temperature-sensitive medications, vaccines, food, biological samples — everything depends on refrigeration systems that are increasingly controlled remotely by connected devices. Germany's BSI (Cybersecurity Agency) classified the attacks as "untargeted and opportunistic," but also reported that a pharmaceutical wholesaler's medicine cooling system was hit. Europe's ENISA agency called for accelerated cross-border cooperation to address the problem.
No group has officially claimed responsibility. Pro-Russian Telegram channels have made claims, but the BSI said it has no evidence for this and does not rule out copycats. Regardless of who is behind it, the result is the same: the infrastructure that should keep our food fresh and our medications safe is being operated by people who know most retailers don't update their temperature controllers — and that, even if they did, they would never dare disconnect a supermarket refrigerator from the internet.
The unsettling question is how many other critical supply chains are running outdated software with factory passwords, hoping nobody notices. Because someone noticed — and wasn't looking for profit.
Sources: PithWire, TechSpot, The National
✓ Independent sources cross-checked and verified before publishing
