Hacked blood banks, breached supermarket fridges and plane bomb hoaxes: What’s going on in Europe?
After a week in which several European sectors were thrown into disarray, how concerned should the continent be of hybrid warfare by hostile adversaries? Alex Croft reports
https://www.independent.co.uk/news/world/europe/uk-europe-cyber-attacks-b3079159.html?fbclid=IwdGRjcAVcWW5jbGNrBVxZXmV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEfCYFDsGBuAzl4XjWZgjYRsJEmbDCNEJddx2BG16eta1dw8DztTVet7ddOP00_aem_sCcKf94FNmPWso_bLc7-2A

The incident, which affected hundreds of European supermarkets, should be a wake-up call to U.S. facilities with internet-vulnerable building automation systems, a security specialist says.

Facilities Dive
Sign up
menu
Dive Brief
Hack of Danfoss refrigeration controllers in Europe causes tens of millions in food losses
The incident, which affected hundreds of European supermarkets, should be a wake-up call to U.S. facilities with internet-vulnerable building automation systems, a security specialist says.

Published Oct. 13, 2026
Robert Freedman’s headshot
Robert Freedman
Lead Editor

Share

License

Add us on Google
Add us as a Google Preferred Source to see more of our articles in your search results.×
Danfoss, grocery store refrigeration system breach, Modbus, Intermarché, Carrefour, Coopérative U, E Leclerc
Intermarché La Pallice supermarket photographed June 28, 2019, in La Rochelle, France. Intermarché is among the European grocery store companies whose refrigeration systems were breached on Oct. 12, 2026, causing widespread loss of refrigerated products. AdrianHancu via Getty Images
Dive Brief:
Hundreds of European supermarkets were forced to throw away tens of millions of dollars worth of grocery products Monday when hackers accessed a network-vulnerable control system and locked refrigeration units into defrost mode for several hours, according to news reports.
Danish control system manufacturer Danfoss, which acknowledged the breach of its systems late Monday, said its AK-SM800 and AK-SC355 refrigerator regulator systems were involved in the incident. In a statement to Agence France-Presse, Danfoss called most of the affected equipment “legacy” products that “no longer receive software or security updates,” AFP reported.
Danfoss, a major supplier of building control systems in the United States, told AFP that it has long advised supermarkets to update the firmware of these models and to “migrate legacy systems to current-generation solutions.”

Dive Insight:
By locking the defrost setting on, the hackers raised the temperature of the refrigeration units to up to 122 degrees Fahrenheit overnight, Reuters reported.

Units in France, Spain, Portugal, Poland, Germany and Belgium were affected, Reuters reported based on an analysis by Sekoia Threat Detection and Research, a private cybersecurity company.

An estimated 150 refrigeration units operated by Intermarché, a France-based grocery store chain, were affected. Units in stores owned by Carrefour, Coopérative U and E Leclerc, among other European grocery stores, were also affected, according to reports.

“Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is of extreme gravity and is unprecedented,” Coopérative U CEO ​Dominique Schelcher said in a statement Monday posted on X.

Cybersecurity specialists have been raising concerns over network-connected building system vulnerabilities for years, in part because of their reliance on protocols that were designed decades ago without security in mind. In Europe, Modbus is a widely used communication protocol for building automation systems, according to a report by Armis from ServiceNow. The DanfossAK-SM800 and AK-SC355 refrigerator regulator systems are on Modbus, according to Danfoss documentation on its website. The company didn’t immediately respond to a request for comment.

“The cyber attack … should raise the alarm for any company that is responsible for handling temperature-sensitive products,” he wrote. “Industrial control systems such as refrigeration controllers are often assumed to be on safely isolated networks [but] many of these devices are directly exposed to the public internet.”

Cybersecurity specialists previously flagged the Danfoss vulnerabilities. The U.S. Cybersecurity and Infrastructure Security Agency published an advisory on an authentication flaw in Danfoss’s AK-SM 800A system managers. And Claroty’s Team82 unit called out that system’s vulnerabilities in August.

“Our research uncovered a hidden ‘code-of-the-day’ authentication mechanism that could be abused to bypass normal authentication,” the Claroty analysis said. Other vulnerabilities were found as well.

In a report released earlier this month, Armis from ServiceNow said 73% of organizations have at least one known exploited vulnerability in their building systems. That exposure is likely to grow, it said, because 91% of the systems that organizations are using communicate over insecure protocols.

The high proportion of vulnerable systems stems in part from the legacy BACnet standard that most building systems in the U.S. use, the company says. The standard was introduced in the 1990s without security protocols because the systems at the time weren’t network-connected. The widely used Modbus standard in Europe has the same legacy vulnerabilities, according to the Armis from ServiceNow report.

“Modbus and similar standards were built for reliability in isolated networks, often without authentication or encryption,” the report says.

Having network-connected systems makes maintenance easier and reduces costs because it enables engineers to troubleshoot issues remotely, Preminger said. But “it also lowers the barrier to entry for attackers.”

Hackers probed Europe’s fridge systems weeks before cyberattacks. Who did it and what could they target next?
https://www.euronews.com/2026/11/07/hackers-probed-europes-fridge-systems-weeks-before-cyberattacks-who-did-it-and-what-could-?fbclid=IwVERDUAVcKQBleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABH_UXUXuGhTTgbe35U8sxJp0SPkCsFqFjm3KjoWS_BKjOut_AqUR0wbPwZU8Y_aem_OdsEciB56KRM-50Z8UdhZw

The attacks exposed basic security weaknesses in connected refrigeration systems, but experts warn that similar vulnerabilities could put everything from supermarket equipment to hospital and data centre infrastructure at risk.
Cybersecurity researchers say they detected hackers probing internet-connected refrigeration systems across Europe in the days before a wave of cyberattacks and incidents disrupted supermarkets and blood banks, with evidence suggesting it may have been part of a coordinated operation.

Refrigeration systems in supermarkets across nine European countries as well as several blood banks in France were attacked on 2 and 3 November.

Hackers exploited weak cybersecurity and vulnerabilities in manufacturer Danfoss’s AK-SM refrigeration system manager to put fridges and freezers on defrost settings, in some cases temperatures were set as high 50 degrees Celsius.

The incidents forced many grocery stores to throw away spoiled produce from their fridges and freezers and have become a very visible example of how easily cyberattacks can disrupt everyday life by targeting infrastructure systems that are often taken for granted.

For cybersecurity firm Lupovis, the signs point to a coordinated operation potentially involving a state actor — one that was preceded by days of probing.

The company says it saw a period of reconnaissance targeting these systems just days before the attacks.

The company observed over 276 attempts coming from 91 different threat actors matching specific components of Danfoss controllers during this 10-day period. Activity peaking on 26 October, before coming to a halt at the end of the month.

“Between the 20th and 30th of October, what we saw was a wave of what we call reconnaissance,” CEO Xavier Bellekens told Euronews Next.

“Between the 20th and 30th of October, what we saw was a wave of what we call reconnaissance,” CEO Xavier Bellekens told Euronews Next.

“We see a huge peak suddenly for 10 days where adversaries are trying the default passwords. They are trying a couple of those vulnerabilities.”

Lupovis operates a system of so-called “honeypots”, which replicate its clients’ online systems and technologies. The company equips them with sensors and then deliberately exposes them to hackers, encouraging attacks so it can track how these systems are accessed and exploited.

This intelligence can then be used to identify vulnerabilities without putting the clients’ real systems at risk.

It was through this system that Lupovis, whose clients include the Scottish government, Orange, Telefonica and a number of retail companies, detected what it describes as “reconnaissance” on Danfoss systems in the days before November’s attacks.

“You can think of it as like burglars, driving through your neighbourhood and identifying the houses they are going to go and break into,” said Bellekens.

Who was behind the attacks?
Lupovis then traced what it describes as the digital “breadcrumbs” left by the probing and attacks, finding that so-called “bulletproof hosting” was used — web hosting services that are designed to resist takedown requests and law enforcement intervention.

“On the one hand, you have Amazon Web Services, they are the opposite of a bullet-proof hosting. If you do something malicious with one of their servers, that’s it, they cancel your account. Bulletproof hosting is the opposite. You do something malicious, It’s out of jurisdiction,” Bellekens said.

“We realised that some of those bulletproof hosting had been used by Russian groups in the past,” says Bellekens.

According to the CEO, Lupovis sensors in South America, Africa, North America and Asia did not record the same activity. It was only picked up by sensors in Europe.

He also believes the ability to coordinate attacks across Europe helps narrow down the list of suspects.

“You [the attacker] have to be able to coordinate this attack because most of it happened within a 24-hour period.”

“All of this makes us point to an adversary that, to us, is not a script kiddie [an unskilled amateur]. They are not a lone wolf. It looks like a well-planned operation. So a state fits the bill.”

“When we pull on the thread it does look like it could well be Russia. So, that is basically where we’re at.”

The incidents come amid wider concerns about hybrid threats and suspected Russian-linked activity targeting European countries.

However, the precise identity and motivation of the attackers remain unclear.

George Nott, technology editor at The Grocer, said the attacks appeared to have relied on relatively basic security weaknesses rather than highly advanced hacking techniques.

“Attackers managed to access refrigeration systems by simply finding their log-in pages on the open internet, and exploiting already patched vulnerabilities and weak passwords rather than some highly advanced technology,” he told Euronews Next.

https://www.iltalehti.fi/digiuutiset/a/41d3cee4-148f-4ddc-a2a9-5446eaf20c64?utm_medium=Social&utm_source=Facebook&utm_variant=nativeimage#Echobox=1794035793