Cyber Attacks on European Refrigeration Systems Preceded by Days of Digital Reconnaissance

A coordinated series of cyber incidents targeted internet-connected refrigeration systems across nine European countries and several blood banks in France on 2 and 3 November, forcing grocery stores to dispose of spoiled food. According to cybersecurity researchers, the disruption was preceded by ten days of systematic digital reconnaissance targeting specific equipment vulnerabilities.

The attacks compromised Danfoss AK-SM refrigeration system managers by exploiting unpatched vulnerabilities and factory-default login credentials. Internal temperatures in some affected facilities were remotely adjusted to 50 degrees Celsius, defrosting commercial freezers. Cybersecurity firm Lupovis reported observing 276 probing attempts from 91 distinct threat actors targeting Danfoss controllers between 20 and 30 October. Lupovis chief executive Xavier Bellekens stated that reconnaissance activity peaked on 26 October before ending at the turn of the month.

Lupovis traced the preliminary activity to bulletproof hosting infrastructure, which the firm noted had previously been used by Russian cyber groups. Bellekens stated that the geographical targeting was confined to European sensors and suggested the level of coordination pointed to a state-backed entity. Moscow's position is not cited in the source, and no group has claimed responsibility for the disruptions. George Nott, technology editor at The Grocer, noted that the intrusions relied on basic security omissions on open internet log-in pages rather than advanced techniques, adding that the precise motives remain unconfirmed.

European authorities differed in their official assessment of the events, with agencies in Belgium, Luxembourg, Italy, Portugal, and Estonia classifying them as cyberattacks, while Sweden and Ireland designated them as cyber incidents. Industry experts highlighted wider systemic risks across connected physical infrastructure, including heating, ventilation, access control, and medical facility equipment. Kumar Sokka, chief executive of Acre Security, stated that while the European Union's NIS2 Directive mandates risk management for digital networks, many organisations continue to manage physical control systems under facilities maintenance rather than critical security protocols.

Cybersecurity experts warn that automated tools and artificial intelligence are reducing the time required for threat actors to turn software vulnerabilities into functional exploits. Gianni Cuozzo, chief executive of Italian security firm Exein, stated that relying solely on software patches is insufficient for remote controllers deployed long-term in the field. He noted that connected devices require built-in runtime defense capabilities to autonomously block unauthorized behavior regardless of whether a security patch has been issued.

Written by Thomas Nussbaumer thomas.nussbaumer@alpineweekly.com