MediumII Cyber Warfare & Critical Infrastructure4 November 2026, Wednesday
Second wave of fridge cyberattacks spreads from supermarkets to French blood bank
A second wave that began on 2 November hit supermarket refrigeration in 6 countries and 3 sites of EFS, the French blood agency. EFS said no blood products were lost; no one has claimed the attack.
According to NBC News, the attacks on 2 November affected Sweden, the Netherlands, Belgium, Ireland, Luxembourg and Estonia. In Belgium, 15 of Carrefour's more than 700 stores were affected, along with 5 Spar outlets belonging to Colruyt and 1 Ikea store in Mons. In Ireland 13 of Musgrave's SuperValu stores were hit, and in Sweden 6 Coop stores. Sabcobel, the Belgian refrigeration company that operates Delhaize's systems, is among the affected suppliers.
According to CNBC, cold stores at 3 processing and distribution sites of EFS, France's blood agency, were attacked on the same day. The target was not EFS's own system but units operated by external service providers. The attackers remotely raised temperature and defrost thresholds; alarms gave early warning and samples were moved to other sites. In the first wave in October, cabinets in hundreds of French supermarkets were heated to as much as 50 degrees.
The attacks have moved from supermarket chains to the healthcare cold chain, but the method is unchanged. The target is internet-facing operational technology, the control software that runs physical equipment. Sweden's cyber security centre said many exposed devices in the country were awaiting patches. Neither of the 2 sources covers insurance for the damage, the amount of cover or whether the state-backed attack exclusion would apply; this item could not be verified.
Talay assessment
Bottom line
The second wave shows the attack was not a one-off French incident: through shared suppliers and exposed control software it can spread to 7 countries. The jump to a blood bank suggests the target is now the critical cold chain rather than food. The most likely path is for regulators to mandate patching and disconnection for refrigeration control systems.
Likely effects
- Critical infrastructureUncertainWeeks
Because the healthcare cold chain was targeted, operational technology oversight accelerates at ANSSI and EU level, and vendor connections are cut.
- Cyber insuranceNegative1–6 months
With waves repeating the same method, insurers may price shared-supplier risk as an aggregate loss; cover data has not yet been verified.
- Retail costsNegativeWeeks
Disposal of spoiled goods and manual monitoring raise supermarket chains' cold-chain operating costs through the winter.
Possibilities, ranked
- 1Patching and disconnection55%
Vendors update their software, a third wave stays limited and the episode turns into regulatory enforcement.
Watch: An advisory on refrigeration control systems from ANSSI or ENISA
- 2A third wave and a new sector30%
The attacks reach pharmaceutical warehouses or hospital cold chains, and products are lost.
Watch: A cold-store incident report at a healthcare site in a new country
- 3The perpetrator is identified15%
A state attributes the attacks to a group, and the episode moves onto the sanctions agenda.
Watch: A formal attribution statement from the EU or a national government
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Countries affected▲ 7
- EFS sites▲ 3
- Blood products lost▼ 0