Cyberattacks that disrupted supermarket refrigeration systems in several European countries on November 2 and 3 were preceded by days of probing, according to cybersecurity firm Lupovis. The company said it recorded more than 276 attempts targeting features associated with Danfoss AK-SM controllers between October 20 and 30.
Lupovis said the activity came from 91 different threat actors and peaked on October 26. Its findings came from sensors attached to “honeypots”—decoy systems designed to attract and monitor attempted intrusions without exposing clients’ live equipment.
The incidents affected refrigeration systems at supermarkets in multiple countries, while a separate incident targeted blood banks in France. French authorities said the attempt to raise storage temperatures did not damage blood products, according to Associated Press.
Attackers exploited exposed controls
In the supermarket incidents, attackers accessed internet-connected refrigeration controllers and switched equipment to defrost settings. Some systems were reportedly set to temperatures as high as 50°C, leaving stores to discard spoiled food.
Lupovis chief executive Xavier Bellekens said the earlier activity involved attempts to use default passwords and exploit vulnerabilities. The company argued that connecting the controllers through virtual private networks rather than exposing them directly to the internet could have reduced the risk.
The reconnaissance and attacks may be connected, but that has not been established. Lupovis said some hosting services linked to the activity had previously been used by Russian groups, while warning that this does not identify the users’ nationality. No confirmed attribution or claim of responsibility has been announced.
George Nott, technology editor at The Grocer, said the incidents appeared to rely on weak passwords and vulnerabilities rather than advanced hacking methods. He also cautioned that responsibility and motive remain unknown, as Euronews reported.
Security specialists say connected equipment beyond refrigeration—including building access, heating and ventilation controls—can also create risks when remotely accessible systems are poorly secured. The incidents have drawn attention to equipment that may be managed outside organisations’ traditional IT security teams.