Fridge Hacks Expose Europe's Fragile Supply Chains

Cyberattacks disrupted supermarket refrigeration across Europe and hit cold-storage monitoring at three French Blood Establishment (EFS) sites, putting systems used to protect blood samples and plasma bags under scrutiny. French authorities and the EFS said no blood products or samples were lost or compromised. The products were transferred or secured, and blood collection and distribution continued without interruption.

Cold storage, remote controls

The EFS said a cyber incident on Monday affected monitoring and control systems for cold-storage rooms at three sites. In a statement released late Tuesday, it said the incident had raised temperature and defrosting thresholds to extremely high levels. Le Canard Enchaîné first reported the incident; it said settings normally at minus 30 Celsius had been targeted for adjustment to as high as 110 C. France 24 reported the same figures.

The EFS said there was “no health impact” and “no loss of blood products”; it also said “no blood products or samples were compromised.” The Health Ministry said monitoring and alarm systems, alongside immediate precautionary measures, preserved the blood supply. Authorities said the situation was under control and closely monitored as they assessed when the equipment could safely return to service.

The attack affected a refrigeration service provider rather than directly targeting the EFS, the establishment said. Coolworld, identified in French media reports as an EFS supplier, said the incident “concerns a component supplied by a third-party provider and not directly controlled by Coolworld.” In a separate statement, it said the reported vulnerability involved a third-party supplier’s component “outside Coolworld’s direct control.” Coolworld said only a “limited number” of its units were affected and that it was taking “appropriate measures.” Responsibility for the component, at least in those statements, sits across a chain of providers.

Food spoiled, systems investigated

Supermarket refrigerators and freezers were also remotely altered, leaving stores to discard spoiled food. Reports said stores in eight European countries threw away large quantities; another report described effects across seven countries and said hundreds of shops were targeted in an overnight attack. Some thermostats were raised remotely to 50C, while other units were put into defrost mode, bringing temperatures to 15C instead of minus 22C. Reports described tons of spoiled food and losses worth millions of dollars or euros.

The attacks echoed an incident in mid-October that affected hundreds of supermarkets and independent stores in France, Belgium and the Netherlands. Another account said dozens of French supermarkets were hit. The varying reported totals offer no single count, but the disruption reached stores and their customers across several countries.

Dutch retail conglomerate Ahold Delhaize said an earlier cyberattack affecting stores in the Netherlands, Belgium and the United States could cut fourth-quarter sales by up to 250 million euros and operating income by up to 100 million euros. CEO Franz Muller said: “While most of the disruption was contained within two weeks, work continues to fully restore our normal operations.” He added: “As we all recognize, cyber threats are an increasingly harsh reality of doing business today.” The company blamed “malicious actions by others” and proactively took some systems offline, including websites and apps for its brands in Europe and the United States.

France’s national cybersecurity agency and the Health Ministry were investigating the blood-storage incident and how it happened. Authorities gave no indication of who might have carried out the attack. The UK National Cyber Security Centre told British retailers to update software on fridge temperature controllers, calling the incident a “wake-up call” and warning that “digital infrastructure remains outdated and vulnerable.”

Official warnings, limited answers

French digital minister Anne Le Hénanff told the country’s Senate the attacks on French refrigerators “have directly targeted our economy and our supply chain.” She said their objective might also be “to undermine the unity of our country and to create anxiety among the population.” The authorities, however, haven’t identified a perpetrator.

French cooperative bank Credit Mutuel Arkea said on Wednesday that a cyberattack had “enabled fraudulent transactions to be carried out,” but clients’ money wasn’t affected. The bank said the incident was contained, operations were resuming and authorities had been alerted.

On Tuesday, bomb hoaxes disrupted European aviation: at least seven flights faced threats, several planes diverted, and an airport in Poland closed. Two Ryanair flights from Dublin and Lisbon were searched after anonymous tips, the airline said. A UK government spokesperson cited “well-tested processes” and said police and intelligence agencies work to assess threats. The incidents brought more disruption, while the source and responsibility for the refrigeration attacks remained unannounced.