The refrigeration attack that failed: what the blood bank got right

What happened in November

The second wave used the same method as the October attacks on French supermarkets: controllers reachable from the internet were reprogrammed to warm fridges and freezers.

• Belgium: dozens of Delhaize stores, 15 Carrefour stores, 10 to 15 Intermarché stores and 5 independently owned Spar stores.
• Ireland: 13 of Musgrave's 223 SuperValu stores.
• Sweden, Finland and Estonia: ICA, Coop, Kesko and Selver stores.
• Netherlands, Portugal, Italy and Luxembourg: at least 17 Dutch businesses, including butchers and small shops, plus stores in the other three countries.
• UK: the National Cyber Security Centre said a small number of UK organisations may be affected and that it is supporting them.

Ahold Delhaize, the owner of Delhaize, has said it expects the attacks to cut its fourth-quarter sales by up to about €250 million. No group has claimed responsibility, and authorities in several countries are investigating.

The blood bank

The same day, attackers targeted the cold storage at three sites of the Établissement français du sang (EFS), France's blood service. Plasma there is kept at about −30 °C. The attackers raised the temperature and defrost thresholds to what EFS called "extremely high levels". French press reported settings of up to 110 °C.

The route in was a refrigeration equipment supplier, which said a vulnerability in a component from a third-party supplier was involved.

Then the attack failed. EFS said its monitoring flagged the problem quickly, staff moved or secured the products in time, and no blood products or samples were lost. Blood collection carried on as normal.

How the attackers got in

Investigators and manufacturers describe the same weak points across countries:

• Controllers reachable directly from the internet, often so contractors could service them remotely.
• Default passwords never changed.
• Old controller models that no longer receive security updates.
• Store equipment connected outside the company's central, managed network.

These are not exotic flaws. They are the ordinary state of many building and refrigeration systems.

What the blood bank got right

We don't know the details of EFS's setup, and it would be wrong to guess. But the outcome shows three things any operator can copy:

1. Monitoring that someone actually watches. An alert is only useful if it reaches a person who can act, at any hour.
2. A plan for what to do next. Staff knew to move or secure products before they were damaged.
3. Not relying on the system to report on itself. A compromised controller can change its own settings and what it shows. A second, independent check is what catches it.

Most supermarkets had cooling. Fewer had a reliable way to know, within minutes, that their cooling had been turned against them.

What to check this week

Drawn from the guidance published by France's CERT-FR and Sweden's NCSC:

1. List every controller connected to the internet, and decide whether each one needs to be.
2. Take controllers off the public internet. Restore remote access only through a secure VPN or protected network.
3. Change default passwords and update firmware. On Danfoss systems, CERT-FR advises setting the security level to Strict.
4. Check setpoints and defrost schedules for changes nobody made on purpose.
5. Plan to replace end-of-life controllers. CERT-FR warns these are very likely compromised and that a factory reset alone leaves them open to attack again.
6. Make sure temperature alarms reach a person at night, and test that they do.
7. Add independent temperature sensors in the most critical cases and cold rooms, so the controller is never the only witness.

This applies well beyond supermarkets: cold stores, pharmacies, hospitals, laboratories and food logistics run on the same kinds of controllers.