A cyberattack does not need to block a website or steal a company’s data in order to cause significant damage. In the past few weeks, several incidents in Europe have shown that it can also disrupt the functioning of physical facilities on which everyday services depend. The refrigeration systems of supermarkets have been manipulated remotely, causing fresh and frozen food to stop being kept at the proper temperature. In France, the same type of problem reached three regional blood bank centers.
The attacks have affected establishments in different European countries and have forced them to withdraw products, move reserves, and review remote control systems. However, not all incidents have had the same consequences: while some supermarkets recorded losses of merchandise, French blood centers managed to protect their reserves thanks to alarm systems and the intervention of their workers.
Experts consulted by EFE warn that these episodes show how a computer vulnerability can end up affecting the food chain or health services. However, there is still not enough evidence to ensure that all the attacks are related, that they are part of the same operation, or that they were executed with artificial intelligence.
European supermarkets: refrigerators manipulated from a distance
The first incidents of this new wave were known at the beginning of November, when several European supermarkets detected alterations in their refrigeration systems. The attacks affected establishments in countries such as Belgium, the Netherlands, Sweden, Ireland, Luxembourg, and Portugal, among others.
In Belgium, dozens of establishments of chains such as Delhaize and Carrefour suffered problems in their refrigerated facilities. In some cases, the systems stopped cooling properly and the stores had to remove food or resort to refrigerated trucks to keep part of the merchandise. The impact was uneven: Carrefour said that the consequences in its Belgian establishments had been limited and that the stores were able to remain open.
In Portugal, seven Intermarché supermarkets suffered an attack that affected their refrigeration equipment. Three of them recorded losses of products, although the company assured that the supply had not been interrupted and that hygiene and food safety conditions were guaranteed.
In Sweden, temperature alterations were also reported in establishments of the ICA chain, with losses of merchandise. In the Netherlands, the incidents mainly affected small shops and butchers.
The total economic scope of this wave has not yet been finalized. The confirmed consequences include spoiled food, preventive product recalls, and problems in the operation of the equipment, but there is no definitive overall tally of losses.
Three French blood banks also suffered the attack
The most delicate episode from a health standpoint occurred on Monday, November 2, in France. Three regional centers of the Établissement français du sang (EFS), the agency in charge of managing blood reserves, suffered an intrusion that affected the surveillance and control systems of their cold-storage chambers.
The attackers managed to alter the temperature and defrosting parameters of the facilities. In these chambers, blood products were stored, including plasma bags intended for transfusions and the manufacture of medicines.
The situation was detected by the alarm systems, which alerted the center staff. The workers moved the reserves to other cold-storage chambers that were not connected to the compromised systems and reinforced monitoring of temperatures.
The French Ministry of Health confirmed that no health impact had been identified and that no blood product had been lost. It also noted that the incident was under control and that remote access to the affected equipment had been disabled.
The investigation continues to determine how the intrusion occurred, which devices were compromised, and when they will be able to be used again safely.
How can a cyberattack spoil food or compromise health reserves
The key lies in the systems that allow controlling physical facilities from a computer. Many supermarkets and healthcare centers use platforms connected to the internet to monitor the temperature of refrigeration units, modify parameters, and receive alerts when an anomaly occurs.
If an attacker manages to access those systems, they can alter their operation without needing to enter the premises physically. In recent incidents, tampering with refrigeration controls made it possible to change temperatures and defrost cycles.
In a supermarket, a temperature increase can break the cold chain and force the removal of fresh or frozen foods that no longer offer guarantees for consumption. In a blood bank, the potential consequences are especially delicate: conserving blood components requires specific conditions, and an alteration can put products intended for medical treatments at risk.
This does not mean that all attacks caused health damage or that reserves were lost. In the French case, alarms and staff intervention prevented the incident from having consequences for blood supply.
Not all attacks involve data theft
One of the important differences in these incidents is that the known target has not necessarily been accessing personal information, stealing databases, or demanding an economic ransom. What has been documented in the refrigeration cases is the manipulation of control systems that act directly on physical equipment.
Therefore, it is worth distinguishing three types of consequences:
-
Operational disruption: the systems stop functioning normally or lose control capability. This is what happened with the refrigeration facilities affected.
-
Material damage or loss of products: a change in temperature can spoil food or put at risk products that require specific preservation. In some supermarkets, it was necessary to discard merchandise.
-
Theft or exposure of data: this is a possible consequence of other cyberattacks, but it has not been confirmed as a result of the refrigeration incidents described.
It has also not been shown that all attacks come from the same perpetrators. The experts consulted by EFE insist that there are similarities in the methods used, but there is still not enough evidence to establish a connection between the different episodes or attribute them to a specific group.
What vulnerability makes it possible to control these devices remotely
Specialists point out that not always do especially sophisticated techniques have to be used to compromise an installation. A weak password, an outdated device, or a poorly protected remote connection can open the door to attackers.
In some of the European incidents, the cooling systems were connected to the internet through remote management platforms. Experts have warned that certain equipment retained default credentials or did not have sufficient security measures.
This makes it possible to understand why a seemingly IT problem can end up affecting a physical activity. Access to a control system not only allows information to be consulted: in certain cases, it also provides the ability to modify the operation of machines, cameras, and other industrial equipment.
Among the measures recommended by specialists are changing factory passwords, keeping software up to date, limiting connections from the internet, separating corporate computer networks from those that control the installations, and having independent alarm systems.
Are the attacks related and who is behind them?
The concentration of incidents in different European countries over a short period has raised the concern of the authorities. However, as of November 7, it has not been confirmed that all of them respond to the same operation nor has their responsible parties been identified in a conclusive manner.
Experts have pointed out that pro-Russian hacker groups have been mentioned, but there is no decisive evidence that would allow the attacks to be attributed to them. It has also not been demonstrated that artificial intelligence was used to carry them out.
The European Commission has closely followed the incidents and coordinated contacts with Europol and the Member States to address the risks to connected infrastructures. The concern goes beyond supermarkets and blood banks: any facility that depends on computer systems to control physical equipment can become a target if its connections are not sufficiently protected.
The main lesson from this wave is that cybersecurity no longer affects only a company’s data or its digital activity. When computer systems control the storage of food or health products, an intrusion can have direct consequences for essential services.