The Fridge-Hacking Spree Is an Internet-of-Things Wake-Up Call
Internet-connected refrigerators at blood banks and supermarkets across Europe have been hacked, causing temperature spikes that spoiled food and threatened medical supplies.
Three sites in France that handle blood and plasma bags were impacted this week by widespread attacks on vulnerable internet-connected refrigerators. On Wednesday, the Établissement Français du Sang (EFS) confirmed that cold rooms storing blood were "raised to very high temperatures" on November 2. The blood samples weren't altered or damaged because the organization's alarm facilities and staff quickly detected the changes and implemented fail-safe measures.
European Supermarket Attacks
The incident comes amid a wave of cyberattacks in recent days affecting supermarket chains in at least 11 European countries that also drastically increased the temperatures of their refrigerators. Pictures from across the continent show huge volumes of food being trashed following the spikes. Similar fridge attacks in October affected hundreds of French stores that were forced to throw away food.
It's been true for more than a decade now that our dependence on connected technology is growing faster than our collective will to protect it, which has exposed us to accidents, adversaries, and now potentially agents.
Vulnerabilities and Responsibility
It remains unclear who is behind the incidents and whether the attacks are connected or being carried out by multiple actors. The first recent wave of attacks against French supermarkets appears to have been caused by exploiting unpatched refrigeration controllers exposed to the internet—including software versions that allegedly used weak passwords.
Many of the hacks stem from vulnerabilities in temperature controllers made by the Danish firm Danfoss. The company stated that impacted systems "were running outdated firmware" and urged customers to keep products updated. The US Cybersecurity and Infrastructure Security Agency warned that attacks could exploit flaws in cold storage systems via authentication bypasses, arbitrary code injections, and weak configurations.
Global Pattern
In August, roughly six commissaries and grocery stores on United States military bases suffered similar incidents resulting in spoiled food. The Pentagon is investigating and collaborating with French law enforcement. Russian hacktivists tried to claim responsibility but provided no credible evidence, while researchers have found potential ties to Iran-linked actors in some cases.
Related
