The attempted sabotage of France's blood-plasma freezers this week showed how far the cyberattacks on Europe's refrigeration systems have spread, from spoiled food in supermarkets to medical supplies. Hackers remotely changed settings at three blood-service sites. Alarms alerted staff in time to protect the plasma. At a food plant in Israel earlier this year, there was no such fortunate outcome.
The Israeli plant's refrigeration engineers had been called in because the cold rooms were warming up. They soon discovered that someone had changed the control settings and passwords, locking them out of the equipment they were supposed to repair.
(Photo: Shutterstock)
Israeli cybersecurity company Profero investigated the attack and found that the controllers' own settings had been used to damage the machinery. The sabotage required no malware on the refrigeration controllers themselves.
“We saw this first in Israel. In May we investigated an attack on a food plant where the attackers didn't just change the temperature. They changed the safety limits, opened the valves, locked the engineers out and burned the compressors. That's physical damage from a keyboard,” said Omri Segev Moyal, Profero's co-founder and CEO.
Omri Segev Moyal, CEO of Profero Photo: Nir SlakmanTwo refrigeration systems were targeted. Engineers restored the older one that night, but the newer controller's configuration had been wiped. They had to reconstruct which sensors, valves and compressors were connected to which inputs and outputs, while forced-open valves had disrupted pressure control.
When engineers tried to restart the machinery, they found three compressors destroyed. Replacement required changes to pipes and electrical connections and days of engineering work. The attackers had also planted destructive malware in the plant's Windows systems. Restoring its computers alone would not get the refrigeration equipment running again.
Profero attributed the Israeli attack to Cyber Isnaad Front, a group it believes is linked to Iran's Revolutionary Guards. There is no public evidence tying the group to the European attacks. In both places, however, attackers reached the equipment that regulates cooling, rather than merely stealing data from office computers.
In France, the attackers reached equipment managed by a refrigeration contractor serving the national blood service, rather than breaking into the blood service's internal network. Remote maintenance arrangements can give outside firms access to critical systems that an organization's own security staff may not see.
Dr. Guy Waizel, Tech Evangelist and Senior Researcher at Cato Networks A contractor may install its own cellular router and SIM card to monitor or adjust a cooling system remotely. The connection can bypass the customer's corporate network, leaving its security team unaware that the machinery has another route to the outside world. Dr. Guy Waizel, Tech Evangelist and Senior Researcher at Cato Networks, identifies such unmonitored access as a major weakness in connected facilities.
The cellular connection is not inherently the problem, Waizel explains. The risk lies in access that the operator has never verified or may not even know exists. A hospital, food producer or retailer may know which company maintains its equipment but not which remote accounts or cellular connections its technicians use.
The problem is hardly new. Danfoss reported that in 2022, attackers compromised its refrigeration controllers at roughly 40 Israeli retail stores, according to Waizel. Those controllers can be difficult to secure even after a vulnerability becomes known, a software update may require compatibility testing and a maintenance window, while shutting down a cooling system can put its contents at risk.
To develop virtual patching protection, Cato used its agentic vulnerability researcher to help reconstruct exploits from Danfoss vendor patch files, with human review. Cato says it added network intrusion-prevention signatures for applicable Danfoss vulnerabilities within 24 hours of the initial incident reports.
Those protections can help block exploitation attempts against covered vulnerabilities when the relevant security controls are enabled and the traffic passes through the inspection point. Remote maintenance links need to be included in that protection, rather than left outside it. The equipment itself still needs updating, but network-level protection can reduce exposure without forcing an immediate shutdown.
Operators need to identify every person and supplier with access to cooling controls, avoid exposing management interfaces directly to the internet, and change default passwords. Where remote access is needed, it should use a secure connection with strong authentication and least-privilege access. Separating industrial systems from office networks and keeping backup configurations can limit the damage. Independent alarms for temperature and settings changes are equally important, since an attacker with control of the unit may also be able to alter or disable its own alarm.
At the Israeli plant, engineers were trying to restore the refrigeration systems while locked out of the controls. “Nobody treats the fridge as a cyber asset. It belongs to maintenance, not to IT. That's exactly why this works,” Segev Moyal said.