A previously unreported wave of recent cyber-intrusions targeting internet-connected refrigeration units in Europe has expanded beyond the initially known supermarket sector, French health authorities confirmed this week. Operators of the French Blood Establishment (EFS) revealed that regulated cold storage rooms holding life-saving donated blood supplies were among the compromised systems, where unidentified threat actors attempted to raise internal temperatures to ruin critical blood products. Rapid, proactive intervention by on-site EFS staff prevented any loss of blood inventory, and health officials have verified zero adverse impacts on patient safety to date. Prior to this disclosure, public awareness of the hack campaign was limited exclusively to disruptions affecting European grocery chain freezer units.
Unsubstantiated online claims have circulated linking the attacks to two Russia-affiliated hacktivist collectives, NoName057(16) and the Z-Pentest Alliance, which posted statements claiming responsibility for breaching systems manufactured by industrial control firm Danfoss, a leading supplier of refrigeration management components. However, independent cybersecurity analysts have cast significant doubt on these assertions, noting that NoName057(16) has a well-documented history of claiming credit for operations it did not execute, and its demonstrated technical capabilities are largely limited to basic distributed denial-of-service (DDoS) traffic flooding attacks, rather than the targeted industrial system intrusions seen in this campaign.
To trace the origin and tactics of the threat actors, three separate cybersecurity firms have deployed specialized digital decoy tools known as “honeypots” across global networks: fake, intentionally vulnerable refrigeration management software instances designed to lure hackers into revealing their scanning patterns, access methods, and operational infrastructure. Teams from Spanish cybersecurity firm Previdian, Scotland-headquartered Lupovis, and French national cyber-defense provider Sekoia have all gathered actionable intelligence from these traps.
Evidence collected from the honeypots shows the second major wave of attacks was highly geographically targeted: Lupovis reported that its decoy systems located in Africa, South America, and even Ukraine received zero probing activity, while all scanning attempts were directed exclusively at European-based fake refrigeration units, starting 10 full days before the second round of intrusions was launched. Researchers confirmed that the targeted refrigeration control devices relied on poorly secured, publicly exposed software with widely documented, easily exploitable vulnerabilities that are openly shared on underground cybercriminal forums.
Ryan Dewhurst, a cybersecurity researcher at Previdian, emphasized that the simultaneous, overnight execution of temperature adjustments across dozens of unconnected facilities required significant pre-planning: actors had to first compile a complete list of public IP addresses for all targeted refrigeration units, coordinate access attempts across time zones, and schedule operations for off-hours to maximize potential product loss and operational disruption.
While investigators have not formally ruled out Russia-linked state actors or hacktivists, Sekoia’s public threat assessment notes that Iran-aligned hacking groups have a long, well-documented track record of targeting internet-connected industrial control systems, including a 2022 breach that compromised 40 Danfoss-managed supermarket refrigeration units in Israel, and a separate late-August 2024 incident that forced freezer systems at six U.S. military bases into full defrost mode. No technical evidence to date has confirmed Russian-speaking threat actors were behind the European refrigeration hacks, Sekoia officials confirmed to reporters.
Investigators also have not dismissed the possibility that a coordinated group of adolescent threat actors, or even unrelated copycat hacking teams, could be responsible for the different waves of intrusions. All three cybersecurity research teams noted that a sufficiently organized group with the required level of operational planning would almost certainly post public boasts of their activity on underground forums in the near future, if they had orchestrated the high-profile campaign. National law enforcement and cybersecurity agencies across multiple European countries have issued formal alerts to supermarket operators, medical facilities, and industrial sites to patch exposed refrigeration control systems and monitor for unusual temperature adjustments, as the investigation to formally identify the perpetrators remains ongoing.