Europe’s Refrigeration Cyberattacks Expose a Weak Link in Critical Infrastructure, Cybersecurity Expert Warns

When attackers remotely changed freezer settings at three French plasma storage sites on November 2, alarms gave staff time to move blood products to unaffected units. France's national blood service said no blood products were lost and reported no health consequences.

For Ray Carney, senior director of research special operations at cybersecurity company Tenable, the breach showed how access granted to a supplier for maintenance can put critical equipment within reach of attackers.

"Treat the vendor as part of your attack surface," Carney said. The French Blood Establishment, known as EFS, said the attack reached its sites through an outside refrigeration supplier and that the blood service was not the direct target.

The sites held plasma for transfusions and for use in making medicines. The breach came amid a wave of attacks on supermarket refrigeration systems across Europe. Retailers in Belgium and Sweden were among those forced to discard spoiled food.

The attackers tried to reset equipment normally held at minus 30 degrees Celsius (minus 22 Fahrenheit) to as high as 110 degrees Celsius (230 Fahrenheit). "A setpoint is a command, not a measurement, so that figure does not establish that freezer interiors or plasma bags actually reached that temperature," Carney said.

He said the method resembled earlier supermarket attacks in which intruders used the controllers' built-in defrost function to drive up temperatures. The French refrigeration systems had been connected directly to the internet with default passwords and ran on technology that no longer received updates.

Carney said that was consistent with attackers scanning for exposed devices, though he said deliberate targeting could not be ruled out. "A controller that can be reached and commanded from the internet doesn't tell an attacker, or a defender, what is stored inside," Carney said.

On November 9, French officials blamed Iran's Islamic Revolutionary Guard Corps for the October attacks on French supermarkets. French authorities are still investigating the November breach at the plasma sites.

"We have no evidence that AI was used in these attacks, and wouldn't suggest otherwise," Carney said. "They used weaknesses that were already well known and left unaddressed." Carney said his concern about AI was how quickly it could help attackers find weaknesses in aging industrial equipment.

The International AI Safety Report 2026 found that AI systems have improved at discovering software flaws and that criminal groups and state-sponsored attackers are using AI to support cyber operations.

For hospitals and blood banks, Carney said the first question for vendors is whether refrigeration equipment needs to be accessible from outside the organization. "If yes, how would losing that remote access tomorrow affect operations or our maintenance contracts?" he said.

He also urged operators to ask how often suppliers update controllers and management software and whether they have a schedule for replacing equipment that no longer receives security updates.

"Any sector where a remotely reachable controller governs a physical condition could see this pattern," Carney said. At water treatment plants, tampering with dosing pumps could compromise water quality.

At power facilities, interfering with cooling systems could force a shutdown. Pharmaceutical labs and biobanks depend on cold storage to protect temperature-sensitive materials, and data centers rely on industrial chillers to keep servers running.

At the French plasma sites, monitoring gave staff time to intervene before blood products were lost. For Carney, the breach gives hospitals and blood banks a reason to find out who can change a freezer's settings remotely and which of those connections their suppliers need to keep the equipment running.