A wave of cyberattacks targeting refrigeration systems across Europe has extended beyond supermarkets to facilities storing donated blood in France.

Cybersecurity researchers have identified signs of a coordinated campaign focused on European targets, but the perpetrators remain unknown. Russian and Iranian-linked hacking groups are among the possibilities being examined.

According to BBC News, the French Blood Establishment (EFS) confirmed that hackers compromised refrigeration systems used to store donated blood. The intrusion could have caused temperatures to rise, but staff intervened before supplies were damaged. EFS reported no impact on public health and no loss of blood products. The incident marks a significant development in a series of attacks previously associated primarily with supermarket refrigeration equipment.

Earlier attacks disrupted supermarkets across eight European countries, with hackers remotely manipulating refrigerator and freezer temperatures and forcing retailers to discard spoiled food. The incidents exposed vulnerabilities in internet-connected industrial control systems, including equipment used to manage commercial refrigeration. The reported attack on blood storage facilities demonstrates how similar weaknesses could affect essential medical services, not just retail businesses.

Cybersecurity researchers have uncovered evidence suggesting that the attacks were planned rather than random. Three companies — Spain’s Previdian, Britain’s Lupovis and France’s Sekoia — deployed digital decoys known as honeypots to monitor attempts to compromise vulnerable refrigeration controllers. These simulated systems allow researchers to observe attackers without exposing operational equipment. Ryan Dewhurst of Previdian told the BBC that the simultaneous targeting of multiple refrigeration units indicated planning and coordination. The reported timing of temperature increases, apparently during nighttime hours, also suggested an attempt to maximize disruption.

The geographical pattern was particularly revealing. Lupovis detected suspicious activity approximately 10 days before the second wave of attacks. Although the company operated decoy systems appearing to be located around the world, attackers concentrated their reconnaissance on European targets. According to Lupovis founder Dr. Xavier Bellekens, decoys in Africa and South America attracted no comparable attention. Even those located in Ukraine were left untouched. The findings suggest that the attackers may have deliberately selected European refrigeration systems rather than indiscriminately exploiting every vulnerable device they could identify.

Who was responsible remains an open question. Pro-Russian hacktivist groups NoName057(16) and Z-Pentest Alliance published claims about successfully compromising Danfoss refrigeration control systems, prompting speculation about their possible involvement. However, Sekoia told the BBC that it had found no technical evidence linking Russian-speaking groups to the attacks. Researchers also questioned the credibility of NoName057(16)’s claims, citing its history of unreliable responsibility claims and its established focus on distributed denial-of-service (DDoS) attacks rather than more complex industrial system intrusions.

Investigators are also examining possible Iranian connections. According to Sekoia, Iran-linked threat actors have a history of targeting internet-exposed industrial control systems. In 2022, approximately 40 Israeli supermarkets using Danfoss controllers were reportedly compromised. The BBC also reported incidents at at least six U.S. military bases in late August, where freezer systems were remotely forced into defrost mode. The controller models involved in those incidents have not been confirmed, and investigations remain ongoing. Researchers have not ruled out independent hackers, copycat operations or different groups carrying out separate waves of attacks.

For Europe, these incidents highlight a growing security concern amid wider fears of hybrid warfare. Compromising relatively simple digital control systems can generate economic losses, disrupt food distribution and potentially threaten medical infrastructure. Such techniques could be used in hybrid operations intended to destabilize societies without conventional military action. Russia has previously used cyber operations and other hybrid methods to pressure European states. No official attribution has been made.

Authorities in several countries are investigating the incidents and warning businesses about further attacks. Researchers caution that the different waves may not share a single perpetrator, even if similar vulnerabilities were exploited. The broader lesson for European security is that critical infrastructure protection must extend beyond power grids, military networks and major transport systems. Refrigeration controllers, medical storage equipment and other internet-connected devices can become entry points for attacks with consequences extending well beyond the digital environment.

Based on BBC News reporting by Joe Tidy, with additional reporting by Chris Vallance.