Supermarkets and plasma banks. Industrial hackers are now targeting electricity and water
The series of attacks on large retailers and suppliers to the French organisation that manages blood transfusions points to an escalation. The claims of pro-Russian groups are raising the stakes. And the audience is wide. ACN has identified over 21,800 NIS entities, subject to cybersecurity regulations: more than 2,000 in the energy sector, 500 in transport, 2,000 in healthcare, 3,000 in the food sector and 4,000 in manufacturing
During the night between 1 and 2 November, the cold chain was compromised yet again. In this instance, the breach occurred via a supplier to the Établissement français du sang (EFS), the French public blood and plasma transfusion service. According to press reports, the systems at three sites, normally set to minus 30 degrees, were reprogrammed to 110 degrees. The target, according to the French press, was Coolworld, a supplier and maintenance provider for numerous storage facilities. Alarms signalled the anomaly, the on-duty technician intervened, and the products and bags were secured. Frédéric Pacoud, president of the EFS, together with the Ministry of Health, have ruled out any health consequences or disruptions to collection and distribution. However, this raid on blood bags comes in the wake of a wave of cyber-attacks on refrigerators in large retail chains across Europe, as well as on numerous machines at US military bases on American soil. It is clear, therefore, that this wave of attacks has far-reaching implications. It calls into question the very foundations of the IoT, Internet of Things.
How the attacks took place
On 12 October, CERT-FR, the French cybersecurity centre, had already reported numerous compromises of Danfoss AK-SM and AK-SC systems and Copeland-Dixell XWEB platforms in the commercial refrigeration sector. The authority called for public interfaces to be removed and for configurations, defrost cycles and alarms to be checked. On 2 November, reports emerged from the Netherlands and Sweden; the alert also affected Belgium, Ireland, Luxembourg, Finland and Italia. On 3 November, the European Commission convened ENISA (the EU’s cyber agency), Europol, EU-CyCLONE (the European Network of Cyber Crisis Liaison Organisations) and national authorities.
NoName057(16) and Z-Pentest, pro-Russian groups, have claimed responsibility in a video for the cyber-attacks on Europe’s commercial refrigeration sector. They claim to have used built-in functions of the Danfoss and Xweb systems without malware, and state that they are capable of interfering with water supplies, power stations and industrial plants. This is a claim, not proof: the authorities have not confirmed that the groups are responsible for all the incidents, nor for the EFS case.
The technique described is, however, plausible. In living-off-the-land, the attacker can use a management console accessible from the outside, stolen credentials or a maintenance technician’s account, without introducing any new industrial software. With the ability to change set-points, defrost cycles or alarms, the attacker carries out normal but unauthorised operations. Investigators will need to trace the session, permissions, work order, modification and controller response. If an account also alters the alarms, the fault may remain undetected.
In February 2026, Copeland published no fewer than 18 vulnerabilities affecting certain Xweb Pro units up to firmware version 1.12.1. The Danfoss AK-SM generations differ in terms of authentication and security settings. For this reason, checks should be carried out on the installed configuration, the access rights granted and reliable backups, rather than relying solely on the manufacturer’s name.
