The attack arrived between Sunday night and Monday morning, and it did not look like a data breach. According to the French Blood Establishment (EFS) and the health ministry, unknown intruders reached into the monitoring and control systems of cold-storage rooms at three regional EFS sites and set "temperature and defrost thresholds to excessively high levels." The units held bags of plasma for transfusions and plasma destined for the manufacture of medicines.

What stopped it was not a firewall. It was a rota. EFS keeps staff on duty around the clock because blood can be needed at any hour; alarms fired, and those staff moved the stock into refrigerators that were not connected to the network, or took the compromised units offline entirely. "No blood products were lost," the EFS said, and no health consequences have been identified. France's cyber agency ANSSI and the health ministry are investigating, and remote access to the affected equipment has been switched off.

The same night, the trick landed on grocery retail across Europe. Roughly 40 Delhaize stores in Belgium and Luxembourg, 13 SuperValu supermarkets in Ireland, 15 Carrefour stores in Belgium, seven of Sweden's 800 Coop outlets plus several ICA shops, K-stores in Finland, a Selver in Estonia. Danfoss told Dutch radio that the cooling systems of at least 17 companies in the Netherlands — butchers, neighbourhood shops — were hit. Freezers in some stores reportedly climbed to 50 °C. One Delhaize branch in Hoeilaart, Flanders, put its own loss at €100,000 of produce, before counting the cost of closing.

The mechanism, as described by Stephan Moelans, CEO of Belgian manufacturer Sabcobel, is almost mundane: the units' evaporators were forced into defrost mode. No exotic malware was required — just the ability to reach a maintenance function over the internet and tell a fridge to warm itself up.

That this keeps working is the uncomfortable part. Moelans said his company had spent the weeks since the previous wave trying to harden customers' fridges against exactly this vulnerability, but that the units needed physical modification, not a software patch. "The simplest solution is to manage the fridges over a secure internet connection," he said, adding that most customers had made that switch after the French incident. Not all of them, evidently.

That earlier incident is the reason agencies are treating this as a campaign rather than vandalism. In early October, police said hackers seized control of cooling units at hundreds of supermarkets in France, causing fires and food losses that local media put in the millions of euros. Same method, same physical payload. Attribution remains open: nobody has claimed the attacks, and it is not publicly established who is behind either wave. Belgium's and Sweden's national cyber agencies said they were monitoring; the UK's NCSC said it was working with international partners and that no British incidents had been reported.

The thread that worries investigators most runs outside Europe. US authorities are investigating refrigeration malfunctions at a number of American military bases in August, and are working with French officials on whether those incidents are connected. If the same access class reaches a base commissary and a blood bank, the target set is not "supermarkets" — it is anything with a networked thermostat and something perishable behind the door.

The EU has been circling this problem for years. Connected building systems — HVAC, refrigeration, access control — are installed by facility contractors, configured once, and then left online for a decade with default credentials, because remote diagnostics is cheaper than sending a technician. Security researchers have warned about it in the abstract; this month it produced empty shelves in seven countries and a near-miss in a plasma supply chain.

The near-miss is the story. A hospital blood bank is a system where a wrong temperature is not an inconvenience but a silent failure mode: plasma that looks fine and is not. What held the line in France was not sophisticated defence but boring resilience — alarms that were monitored, staff who could act, and unnetworked backup capacity to move product into. Three of the cheapest controls in the catalogue, and the only reason this is a scare rather than a scandal.

What to watch next: whether any national agency attributes the campaign publicly; whether Brussels moves from guidance to mandatory security baselines for commercial refrigeration controllers; and how many of the affected retailers had actually taken the "secure connection" advice they were given five weeks ago.

Sources