Hackers changed temperatures in cold storage: IoT attacks across Europe

The Internet of Things (IoT), meaning devices connected to the internet, has long been seen as a poorly secured corner of the digital world. A series of recent incidents in Europe shows that the risk affects not only cameras or routers, but also equipment that protects food and medical products.

Attack on plasma cold storage

On the night of 1 to 2 November 2026, cooling systems used by Établissement français du sang (EFS), the French public body responsible for collecting and distributing blood, were attacked in France. According to the Polish site Spider's Web, the incident affected installations in the Bourgogne-Franche-Comté region, among others.

The attackers did not break into the medical facilities directly, but into the systems of Coolworld, an external provider that services refrigeration equipment. This let them change temperature settings in installations that normally run at around -30°C. At one point the setting was raised to 110°C.

A technician on night duty noticed the anomaly and took action to deal with it. The French Ministry of Health said the incident did not disrupt the transfusion system or affect patients. EFS first said the devices held donor samples, and later admitted that the cold stores also contained frozen plasma intended for transfusions. The number of devices attacked and the exact temperature readings were not disclosed.

Supermarkets earlier

Earlier, a series of attacks on freezers in European supermarkets was reported. Problems were reported in France, Sweden, Belgium, Ireland and Estonia, among others. In some shops the temperature was set as high as 50–70°C, and goods had to be withdrawn from sale. Losses from earlier attacks in France were estimated at millions of euros. Antyweb names foreign Auchan stores among the victims.

Danfoss controllers and the French CERT warning

The author at Antyweb points to Danfoss AK-SM 800A controllers. According to his account, they had a mechanism for bypassing normal login using a code calculated from the production date. Researchers at Team82 reportedly found other vulnerabilities as well, which the manufacturer then patched.

In an October warning, the French CERT reported mass takeovers of Danfoss devices, as well as Copeland and Dixell. It recommended updating software, changing default passwords and securing service connections, and drew attention to administration panels exposed to the internet.

Antyweb also recalls that the FBI warned of mass attacks on IoT as early as 2017, after the well-known Mirai botnet, which used infected cameras, recorders and routers for DDoS attacks. The author stresses that in the case of cold storage, the damage cannot be undone with a backup, and thawed food or plasma cannot be "restored". That is his assessment, not a finding by the authorities.

What the experts say

The description suggests that users' negligence, such as default passwords or open remote access, contributed to the takeovers. Antyweb argues, however, that manufacturers should assume customers will behave carelessly, clearly state how long they will support a product and regularly issue patches. In the EFS case, monitoring and alarms helped, so the author argues for additional physical safeguards.

What this means for you

The sources do not describe attacks in the UK. Ireland is among the countries named in the supermarket attacks, and Spider's Web also mentions similar incidents in Poland. For home users the general lesson is this: keep smart home devices updated, change their default passwords and do not expose their control panels to the internet unnecessarily. Businesses that use remotely managed cold storage should check the security of service access.