Cyberattacks on Refrigeration Systems Highlight Critical Infrastructure Vulnerabilities Beyond AI.

Welcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess, offering insights from inside the new world of privacy and digital security. Amidst a landscape increasingly dominated by discussions around AI vulnerability discovery and sophisticated AI-assisted hacking techniques, a recent spate of critical infrastructure attacks has served as a stark reminder that fundamental cybersecurity practices remain paramount for digital defense. These incidents, which have impacted essential cold chain systems across Europe and the United States, underscore the enduring importance of basic security hygiene over the flashier, though no less serious, threats posed by artificial intelligence.

This week, France experienced a concerning incident where three sites responsible for storing vital blood and plasma bags were briefly affected by widespread cyberattacks targeting vulnerable internet-connected refrigerators. On Wednesday, the Établissement Français du Sang (EFS), France’s national blood service, issued a confirmation regarding a cybersecurity incident. This attack led to the cold rooms storing blood being "raised to very high temperatures" on November 2. Fortunately, due to the EFS’s robust alarm facilities and the swift response of its dedicated staff, the temperature changes were detected promptly. Fail-safe measures were immediately implemented, ensuring that the blood samples remained unaltered and undamaged, averting a potentially catastrophic public health crisis. This quick detection and response highlighted the importance of having both technological safeguards and vigilant human oversight in critical infrastructure operations.

However, the incident at the EFS sites is not an isolated event but part of a broader wave of cyberattacks that have recently swept across Europe. Supermarket chains in at least 11 European countries have been targeted, with attackers drastically increasing the temperatures of their refrigeration units. The consequences have been significant, with widespread reports and images from across the continent showing huge volumes of perishable food being trashed due to spoilage. This economic damage and food waste represent a tangible impact on civilian life and supply chains. Similar refrigeration attacks occurred just last month, affecting hundreds of French stores and forcing them to discard substantial quantities of food products. The pattern extends beyond Europe; in August, approximately six commissaries and grocery stores located on United States military bases suffered comparable incidents, also resulting in widespread food spoilage. The Pentagon has since initiated an investigation into these incidents and is collaborating closely with French law enforcement authorities, as reported by Reuters last week, indicating a serious concern at the highest levels of government regarding the coordinated nature and potential implications of these attacks.

Josh Corman, a longtime critical infrastructure researcher and currently the executive in residence for public safety and resilience at the nonprofit Institute for Security and Technology, offered a poignant perspective on the recurring nature of these vulnerabilities. "It’s been true for more than a decade now that our dependence on connected technology is growing faster than our collective will to protect it, which has exposed us to accidents, adversaries, and now potentially agents," Corman stated. He emphasized the inherent fragility of these systems, adding, "These fragile cold-chain systems are too critical to fail, but we keep experiencing hard lessons." His comments highlight a fundamental challenge in the modern digital age: the rapid adoption of interconnected technologies, particularly in industrial and commercial settings, often outpaces the implementation of adequate security measures, leaving vital infrastructure exposed. The cold chain, which is essential for preserving everything from food and pharmaceuticals to blood products, is a prime example of a system whose failure could have widespread and severe consequences.

The identity of those behind these incidents remains unclear, and investigators are working to determine whether the attacks are interconnected or if multiple actors are operating independently. Early indications suggest that the initial wave of attacks against French supermarkets last month stemmed from attackers exploiting unpatched refrigeration controllers that were directly exposed to the internet. These vulnerabilities reportedly included software versions that used weak, easily guessable passwords, often formulated based on the current date, making them simple targets for malicious actors. Many of the successful hacks appear to have leveraged vulnerabilities in temperature controllers manufactured by the Danish firm Danfoss. Cybersecurity researchers have indicated that these attacks were not particularly difficult to execute, suggesting a low barrier to entry for the perpetrators. Danfoss did not respond to WIRED’s request for comment regarding these incidents.

In other public statements, Danfoss has acknowledged that the impacted systems were "running outdated firmware" and strongly urged its customers to ensure their products are kept updated with the latest security patches. This advice is critical, as outdated firmware often contains known vulnerabilities that attackers can easily exploit. Further reinforcing the urgency of the situation, the US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert on Thursday, specifically addressing the recent rash of incidents. CISA’s advisory detailed that attacks could exploit various flaws in cold storage systems, including authentication bypasses, arbitrary code injections, and weak configurations. These types of weaknesses are common in Internet of Things (IoT) devices, particularly those used in industrial control systems (ICS), and experts have warned for years about the dire threats they pose to critical infrastructure. The proliferation of IoT devices in commercial and industrial environments, often deployed without adequate security considerations, creates a vast attack surface that cybercriminals and state-sponsored actors can leverage.

While definitive attribution remains elusive, the geopolitical landscape adds another layer of complexity to the investigation. Russian hacktivists have attempted to claim responsibility for some of the attacks, although they have yet to provide credible evidence to support their assertions. Despite the lack of concrete proof, some researchers "see signs" that Russia-based actors may have been involved in at least "some" of the incidents, raising concerns about potential state-sponsored malicious activity. The Kremlin, however, has explicitly denied any involvement this week. Adding to the intricate web of potential actors, other investigations have uncovered "potential ties to Iran-linked" entities. NextGov/FCW reported last week that unnamed US officials suspect Iran-linked attackers may have been behind the freezer attacks on US military bases, though they cautioned that the investigation is still ongoing. The possibility of multiple state or state-backed actors targeting critical infrastructure highlights the complex threat environment faced by nations today. The discussion around such attacks even extends to the potential implications under international defense treaties, with some researchers noting that such civilian targeting could potentially "trigger Article 5 NATO" discussions if attribution to a state actor were definitively established and deemed an act of war.

It is important to note that this type of refrigerator/freezer attack is not a new phenomenon. Similar incidents have occurred in the past, serving as previous warnings that went largely unheeded. Back in 2022, 16 supermarkets in Russia were targeted at the start of the country’s full-scale war with Ukraine, indicating that such attacks can be used as a form of cyber warfare or protest. In the same year, 40 stores in Israel were similarly attacked, according to a 2025 report by Danfoss itself. These historical precedents underscore a persistent vulnerability in the cold chain infrastructure that has been exploited repeatedly over several years, demonstrating a systemic issue rather than isolated incidents.

In response to the current wave of attacks, Sweden’s National Cyber Security Center (NCSC) issued a recent advisory, echoing sentiments expressed by experts globally. The NCSC pointed out that "Many businesses use older technology while the systems become increasingly connected." Their recommendations are fundamental yet crucial: companies should meticulously inventory which of their devices are connected to the internet, disconnect them whenever possible, and for devices that must remain connected, ensure they are kept access-controlled, regularly patched, and continuously monitored. This comprehensive approach emphasizes the need for proactive security measures, robust asset management, and continuous vigilance to protect critical systems from evolving cyber threats. The current incidents serve as a powerful testament to the fact that while the spotlight often falls on advanced threats, the foundation of cybersecurity—basic hygiene, patching, and proper configuration—remains the most critical line of defense against both common criminals and sophisticated state-sponsored adversaries.