Refrigerator hacking spree serves as IoT security warning

Three facilities in France managing blood and plasma stocks were impacted this week following widespread cyberattacks on internet-connected refrigerators. The Établissement Français du Sang (EFS) confirmed on Wednesday that cold storage rooms containing blood were “raised to very high temperatures” on November 2. According to the EFS, the blood samples were not damaged or altered because staff and alarm systems identified the temperature shifts and activated fail-safe protocols.

This incident follows a series of cyberattacks across at least 11 European countries that caused significant temperature spikes in supermarket refrigerators. Images from the continent show large quantities of food being discarded. In October, hundreds of French stores faced similar attacks, while roughly six commissaries and grocery stores on United States military bases reported spoiled food in August. The Pentagon is investigating these events and is working alongside French law enforcement.

“It's been true for more than a decade now that our dependence on connected technology is growing faster than our collective will to protect it, which has exposed us to accidents, adversaries, and now potentially agents,” says Josh Corman, a critical infrastructure researcher and executive in residence at the Institute for Security and Technology. “These fragile cold-chain systems are too critical to fail, but we keep experiencing hard lessons.”

It remains unclear who is responsible for the attacks or if they are linked. The initial wave of attacks against French supermarkets last month reportedly involved attackers exploiting unpatched refrigeration controllers with weak passwords. Many of the hacks appear to target temperature controllers manufactured by the Danish company Danfoss.

Danfoss stated that the affected systems “were running outdated firmware” and advised customers to ensure products are kept updated. In a Thursday alert, the US Cybersecurity and Infrastructure Security Agency warned that cold storage systems could be vulnerable to authentication bypasses, weak configurations, and arbitrary code injections.

While Russian hacktivists have claimed responsibility for some incidents without providing evidence, researchers have noted potential links to Russia-based actors. The Kremlin denied any involvement this week. Other reports suggest potential connections to Iran-linked actors, with US officials noting that the investigation into the US military base attacks remains ongoing. Similar attacks were previously documented in 2022, when 16 supermarkets in Russia and 40 stores in Israel were targeted.

Sweden’s National Cyber Security Center recently issued an advisory, noting that “Many businesses use older technology while the systems become increasingly connected.” The agency recommended that companies audit their internet-connected devices, disconnect them where possible, and ensure that any remaining connected systems are monitored, patched, and access-controlled.