Hackers probed Europe’s fridge systems weeks before cyberattacks. Who did it and what could they target next?

Cybersecurity researchers have uncovered evidence that hackers were probing internet-connected refrigeration systems across Europe weeks before a series of cyberattacks disrupted supermarkets and blood banks. The attacks, which occurred on November 2 and 3, involved exploiting vulnerabilities in Danfoss's AK-SM refrigeration system manager in supermarkets across nine European countries and several blood banks in France.

The hackers gained control of the fridges and freezers, causing them to enter defrost mode and potentially raising temperatures to as high as 50 degrees Celsius. The incidents disrupted grocery stores by forcing them to discard spoiled produce, highlighting how easily cyberattacks can disrupt daily life by targeting infrastructure systems that are often overlooked.

The cybersecurity firm Lupovis detected the probing, finding a period of reconnaissance targeting these systems for about a week before the attacks. The researchers observed over 276 attempts from 91 different threat actors exploiting specific components of Danfoss controllers during this 10-day period, with most activity peaking on October 26 and halting at the end of the month.

This "reconnaissance" phase was identified through Lupovis's "honeypots," which replicate real systems and technologies to attract and analyze hacker activity. By tracing the digital breadcrumbs left by the attacks, Lupovis linked the probes to bulletproof hosting services commonly used by state-sponsored threat actors. While Lupovis cannot definitively attribute the attacks to a specific nation, the pattern of activity and the use of such hosting services raise suspicions of a state actor's involvement, potentially Russia.

The attacks come amid broader concerns about hybrid threats and suspected Russian-linked activities targeting European countries. However, the precise identity and motivations of the attackers remain unclear, with cybersecurity agencies in affected countries using varied terminology—such as "cyberattack," "cyber incident," or "cybersecurity incident"—to describe the events.

The attacks may have relied on relatively simple security weaknesses, such as finding default login pages and exploiting weak passwords rather than advanced hacking techniques. While the attackers' exact goals and identities remain unknown, the incident underscores the vulnerabilities of everyday infrastructure systems to cyber threats.