Hackers probed Europe's supermarket fridges for 10 days before attacks — and experts fear hospitals are next

For ten days before hackers sent supermarket freezers across Europe soaring to 50°C, someone was quietly trying the doors. Cybersecurity firm Lupovis recorded 276 attempts from 91 distinct threat actors probing Danfoss refrigeration controllers between 20 and 30 October — activity that peaked on 26 October and then went silent, right before the attacks began.

On 2 and 3 November, refrigeration systems in supermarkets across nine European countries and several blood banks in France were hit. Hackers exploited weak passwords and known, already-patched vulnerabilities in Danfoss's AK-SM refrigeration system manager to switch fridges and freezers into defrost mode, in some cases pushing temperatures as high as 50 degrees Celsius. Stores threw out spoiled produce. Ikea in Belgium pulled food from its units. A Stockholm ICA store announced on social media that its freezers had gone down 'due to a 2am cyberattack,' adding that 'everything was destroyed.' Those November incidents came on the heels of an October wave in France, during which attackers took over cooling units in up to 700 supermarkets, triggering fires and food losses put at tens of millions of euros.

Between the 20th and 30th of October, what we saw was a wave of what we call reconnaissance. We see a huge peak suddenly for 10 days where adversaries are trying the default passwords. They are trying a couple of those vulnerabilities.— Xavier Bellekens, CEO, Lupovis

Lupovis operates a network of 'honeypots' — decoy systems that replicate clients' real infrastructure, equipped with sensors and deliberately exposed to hackers so the company can track how attacks unfold without putting live systems at risk. Among its clients are the Scottish government, Orange, Telefonica and a number of retail companies. It was through this network that the firm detected the reconnaissance sweep targeting Danfoss components in the days before November's attacks.

You can think of it as like burglars, driving through your neighbourhood and identifying the houses they are going to go and break into.— Xavier Bellekens, CEO, Lupovis

Tracing the digital trail left by the probing, Lupovis found that the attackers used 'bulletproof hosting' — web hosting services specifically designed to resist takedown requests and law enforcement intervention. When the firm examined those hosting providers, a pattern emerged.

We realised that some of those bulletproof hosting had been used by Russian groups in the past.— Xavier Bellekens, CEO, Lupovis

Bellekens is careful about what that means. He acknowledges that the location of a server does not establish the nationality of whoever is operating it. But he points to two further details: Lupovis sensors in South America, Africa, North America and Asia recorded none of the same activity — it was detected only in Europe. And the attacks themselves were compressed into roughly a 24-hour window, implying the capacity to coordinate across multiple countries simultaneously.

All of this makes us point to an adversary that, to us, is not a script kiddie. They are not a lone wolf. It looks like a well-planned operation. So a state fits the bill. When we pull on the thread it does look like it could well be Russia. So, that is basically where we're at.— Xavier Bellekens, CEO, Lupovis

On 4 November, two pro-Russian hacking groups — NoName057(16) and Z-Pentest Alliance — briefly took credit for the attacks, asserting that they possessed an extensive database of login credentials and that manufacturers had neglected basic security measures. Neither group provided evidence. Danfoss told Danish television it had no evidence that its internal IT infrastructure had been hacked or any data leaked. The groups subsequently deleted their posts claiming responsibility, according to TVP World.

The Kremlin flatly rejected the accusations. Spokesman Dmitry Peskov called them 'absurd' and 'unfounded,' saying they lacked any argumentation or evidence.

Well, these are absurd allegations. As always, they are not supported by any argumentation or any evidence. Such unfounded accusations against our country, alleging its involvement in everything, are unfortunately becoming a persistent trend in European countries.— Dmitry Peskov, Kremlin Spokesman

Not everyone is ready to point the finger at Moscow. George Nott, technology editor at The Grocer, stressed that the attacks relied on basic security failures rather than advanced techniques — and that the absence of any ransom demand or verified claim of responsibility leaves the field wide open.

Attackers managed to access refrigeration systems by simply finding their log-in pages on the open internet, and exploiting already patched vulnerabilities and weak passwords rather than some highly advanced technology. It's still unclear who was behind the attack or what they hoped to achieve. We'll have to face the fact we may never know. With no ransom demand or claim of responsibility, it could have been anyone from a state-sponsored actor to a gang of teenagers 'doing it for the lols'.— George Nott, Technology Editor, The Grocer

Tom Hegel of cybersecurity firm SentinelOne told Reuters that the absence of financial demands points toward sabotage rather than extortion. Tributech's Patrick Lamplmair cautioned that the method was 'cheap and the damage is immediate,' warning that attackers would persist 'until it stops working,' and he noted that thousands of vulnerable controllers remained reachable from the internet even after the French attack. Lamplmair added that 'a few commands to a temperature controller can destroy stock overnight and close stores.'

EU food and agriculture commissioner Christophe Hansen described the repeated attacks as 'a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it.' John Billow, head of Sweden's national cybersecurity centre, said the country had 'quite a lot of exposed operational technology devices' that needed updating or patching. Polish cybersecurity specialists put the number of potentially vulnerable refrigeration-control devices in that country at around 140, and Poland's Central Bureau for Combating Cybercrime reported that it had observed 'increased activity by cybercriminals targeting commercial entities' that use refrigeration systems.

How the access happened is not in dispute. Controllers connected directly to the open internet — rather than through a virtual private network — were remotely managed, and many retained factory-installed credentials. Some systems could be accessed with a username of 'Supervisor' and a password of '12345,' according to spotmedia.ro. Bellekens said that channelling these devices through a VPN 'would have completely eliminated the risk, as exploiting a VPN connection is more complicated.'

Experts warn the same class of vulnerability extends well beyond supermarkets. The security weaknesses exposed in refrigeration controllers — internet-exposed industrial systems with default credentials and unpatched software — are present in hospital cooling equipment and data centre infrastructure, raising the stakes considerably if attackers choose to escalate their targets.

No national authority has officially attributed the attacks to any country or organisation. How governments have characterised the events has varied: Belgium, Luxembourg, Italy, Portugal and Estonia used the term 'cyberattack,' whereas Sweden and Ireland opted for the milder label 'cyber incident.' The EU's own cybersecurity agency, ENISA, has stopped short of explicitly calling them a cyberattack at all.

Why it matters — The same basic vulnerabilities that let hackers destroy supermarket food overnight — internet-exposed industrial controllers with default passwords — are present in hospital cooling systems and data centres, meaning the method could be turned against far more critical infrastructure.

Sources differ on Whether the incidents constitute a 'cyberattack': Called a 'cyberattack' by Belgium, Luxembourg, Italy, Portugal and Estonia (euronews.com) vs Called a 'cyber incident' by Sweden and Ireland (euronews.com) vs ENISA stopped short of explicitly calling the incidents a cyberattack (euronews.com)

Reported by euronews.com, theguardian.com, tvpworld.com, spotmedia.ro