Amid an onslaught of AI vulnerability discovery and AI-assisted hacking, some of the most consequential critical infrastructure attacks this year may have little to do with the technology at all—instead providing a stark reminder that cybersecurity fundamentals are still key to digital defense.
Three sites in France that handle blood and plasma bags were briefly impacted this week by widespread attacks on vulnerable internet-connected refrigerators. On Wednesday, the Établissement Français du Sang (EFS) confirmed that cold rooms storing blood were “raised to very high temperatures” on November 2. The blood samples, thankfully, weren’t altered or damaged, the EFS said, because the organization’s alarm facilities and staff quickly detected the changes and implemented fail-safe measures.
The incident, however, comes amid a wave of cyberattacks in recent days affecting supermarket chains in at least 11 European countries that also drastically increased the temperatures of their refrigerators. Pictures from across the continent show huge volumes of food being trashed following the spikes. Similar fridge attacks in October affected hundreds of French stores that were forced to throw away food. And in August, roughly six commissaries and grocery stores on United States military bases suffered similar incidents resulting in spoiled food. The Pentagon is investigating the incidents and is collaborating with French law enforcement, Reuters reported last week.
“It's been true for more than a decade now that our dependence on connected technology is growing faster than our collective will to protect it, which has exposed us to accidents, adversaries, and now potentially agents,” says longtime critical infrastructure researcher Josh Corman, who is currently the executive in residence for public safety and resilience at the nonprofit Institute for Security and Technology. “These fragile cold-chain systems are too critical to fail, but we keep experiencing hard lessons.”
It is still unclear who is behind the incidents and whether the attacks are all connected or being carried out by multiple actors. The first recent wave of attacks against French supermarkets last month appears to have been caused by attackers exploiting unpatched refrigeration controllers exposed to the internet—including software versions that allegedly used weak passwords formulated based on the date.
Many of the hacks stem from attackers exploiting vulnerabilities in temperature controllers made by the Danish firm Danfoss, and researchers say the attacks would not have been particularly difficult to pull off. Danfoss did not return WIRED’s request for comment.
In other statements, Danfoss said impacted systems “were running outdated firmware” and urged customers to keep products updated. In an alert on Thursday addressing the rash of incidents, the US Cybersecurity and Infrastructure Security Agency said attacks could exploit flaws in cold storage systems via authentication bypasses, arbitrary code injections, and weak configurations. Experts have long warned about the dire threats to critical infrastructure posed by these types of weaknesses in so-called internet-of-things devices.
Russian hacktivists tried to claim responsibility for some of the attacks but did not provide credible evidence. Still, some researchers see signs that Russia-based actors may have been involved in at least some of the incidents. The Kremlin this week denied involvement. In other cases, researchers have found potential ties to Iran-linked actors. NextGov/FCW reported last week that unnamed US officials suspect Iran-linked attackers may have been behind the freezer attacks on US military bases, though they noted that the investigation is still ongoing.
This type of refrigerator/freezer attack is not new. Back in 2022, 16 supermarkets in Russia were targeted at the start of the country’s full-scale war with Ukraine. That year, 40 stores in Israel were similarly attacked, according to a 2025 report by Danfoss.
“Many businesses use older technology while the systems become increasingly connected,” Sweden’s National Cyber Security Center pointed out in a recent advisory about the freezer attacks, noting that companies should inventory which of their devices are connected to the internet, disconnect them whenever possible, and make sure they are kept access-controlled, patched, and monitored if they must be connected.
