Russia is attacking Europe. If you balk at that phrase, instead of accepting it, the attack methods are working as designed. The infrastructure of refrigeration is in danger, which on the night of 1 to 2 November meant disruption directed at France’s blood supply.
Why blood? We could ask the same question of the “hospital trains” disrupted by Russia in the weeks after NATO announced they would roll from the Netherlands all the way to the Russian border as proof of wartime capabilities.
I think by now everyone knows about refrigeration controllers being warmed. Fridges and freezers at night, connected to networks, are being popped at supermarkets in Belgium, Luxembourg, the Netherlands, Germany, Sweden, Finland, Estonia, Ireland, Portugal and Italy. Danfoss confirmed its equipment was involved, just like it was in France on 11 October. But let’s talk for a moment about the refrigeration contractor for the Établissement français du sang, which lost control of cold rooms holding blood products.
Le Canard enchaîné reported on 3 November that the setpoint on containers maintained by Coolworld, including sites in Bourgogne-Franche-Comté, was changed from minus 30°C to 110°C. That’s a lot of Fahrenheit. A technician on night duty saw the temperature in the cold rooms rising. The Health Ministry says the simple detection prevented any operational consequence. The EFS first described the contents as donor samples kept for transfusion monitoring, then confirmed that frozen plasma for transfusion was among the products in the targeted units.
Again, that’s a specific target of Russia for a particular reason. Transfusion centers are one of the puzzle pieces of NATO defense capabilities.
The October post here had brought up ANSSI searching for other exposed companies before the attack spread, and it highlighted two gaps: scan history, and Danfoss sites outside France. I think we have answers now.
| Country | Company (stores) |
|---|---|
| Belgium, Luxembourg | Delhaize (several dozen), Carrefour (15), Intermarché (10 to 15), Spar (5), IKEA Mons (1) |
| Netherlands | 17 businesses including butchers |
| Germany | Edeka Reisbach, stores in North Rhine-Westphalia |
| Sweden | ICA (limited number), Coop (6 or 7 of about 800) |
| Finland | Kesko (a few smaller stores) |
| Estonia | Selver (1) |
| Ireland | Musgrave SuperValu (13 of 223) |
| Portugal | Intermarché (7) |
| Italy | Coop, Radenza Group (at least 4, Sicily) |
Answers? Let me be clear. Every country on that list supports Ukraine, and all but neutral Ireland send it weapons. The map of the second wave is the map of European support for Kyiv, minus France, hit three weeks earlier.
Reuters established in July 2025 that Elon Musk ordered Starlink coverage cut over part of Kherson in late September 2022, in the middle of Ukraine’s counteroffensive, which left units without communications and let Russian positions escape encirclement. Every day Russia holds Ukrainian ground is a day of Russian strikes on Ukrainian civilians, and every one of those strikes is a demand on a transfusion service. See the connection?
The attack method in question here is the one from France. Sabcobel, which runs refrigeration for Delhaize, said units were simply switched into a defrost mode. An ICA store in Sjöbo found its fridges and freezers set to 50°C. A Selver freezer in Estonia was set to 50°C on an older Danfoss controller and caught within ten minutes. A butcher in Hove near Antwerp found his fridges at 18°C and lost about 15,000 euros of meat.
The door was the one from France too, and it was a cheap door. Flimsy, weak, to a point we shouldn’t even call it a door. ANSSI director Vincent Strubel told the French Senate on 21 October that the agency’s assessment of the October cases pointed to exposed administration interfaces and trivial passwords, and that the vulnerabilities Claroty published earlier in the year were absent from the path. The October post spoke to those vulnerabilities and the firmware that fixed them. The attackers needed a login page on the public internet and a bad password that nobody changed. Danfoss told NOS the Dutch systems that were hit sat on open networks with default passwords, that most targets had locked down after the French attack, and that the few who had not were the ones hit. Sabcobel said many but not all of its customers had secured their connections. Selver said the store that was hit was the last one it had yet to move to a new system. Three weeks of public warning had sorted targets into two groups, meaning the victim list is a discrete second group. The breach-of-duty argument from October has a clear control group.
The vendor was well aware of this attack for at least the past four years. A Danfoss application note from 2022 documents attacks on sixteen Russian supermarkets and forty Israeli stores, and records that the Israeli installations lacked firewall or VPN protection.
I’ll say that again. Russian supermarkets are on the 2022 list.
The Danfoss security advisories page listed nothing about either 2026 wave as of 3 November. CERT-FR alert CERTFR-2026-ALE-012 was last updated on 16 October. It covers the Danfoss AK-SM and AK-SC series and the Copeland and Dixell xweb lines, says the campaigns are probably still underway, and advises operators to check their insurance contract before cutting the data feed to their refrigeration contractor.
The blood case is interesting because it differs from the stores in two ways.
The first is a degree. Every store that reported a setpoint had reported 50°C. Hot! But the EFS containers were set to 110°C, and that figure is a programmed instruction rather than a measured temperature. A different temperature ceiling points at a different controller, and the controller vendor in the Coolworld case is still unnamed.
The second is a detection. Most stores found out late, from staff opening doors in the morning or from alarms. The EFS found out during the early moves, because someone on night shift had a job to observe the thermometer.
The identical attack already carries a Russian name on a US indictment. The US Justice Department announced on 9 December 2025 charges against CyberArmyofRussia_Reborn and NoName057(16), alleged Russian government backing for both, and attributed to CARR a November 2024 intrusion at a Los Angeles meat-processing plant that spoiled the meat and caused an ammonia leak. The joint advisory published the same day by the FBI, CISA, NSA and allied agencies describes these groups selecting operational-technology victims on availability and existing exposure. A refrigeration controller on a public address with a default password is such an obviously bad idea, do I even have to say it fits? Eleven months later the Russian TTP ran across ten European countries in one night. EU Agriculture Commissioner Christophe Hansen called it a deliberate attempt to disrupt the food supply chain.
Food supplies, blood supplies. What do you think nations tell their citizens to have ready during a war? Not a coincidence that Britain has recently been telling people to stockpile food in case of… well, they haven’t said exactly.
The officials reading logs have chosen words carefully. Belgium’s Centre for Cybersecurity told reporters on 2 November that the identity of the attackers was unknown and “it may never be determined”, while the federal prosecutor opened a criminal investigation. Sweden’s National Cybersecurity Centre is sharing information with Nordic and European agencies. Danfoss said the Dutch attacks were the same kind as in France, Sabcobel said the same method was used in Belgium, and Kitman Coldtech said the method in Estonia was similar. A shared method across ten countries on one night, three weeks after a rehearsal in one country, is a campaign.
The lack of EU preparedness for integrity breaches is incredibly frustrating to me, as I’ve been banging the gong on this since at least 2012.
A Russian campaign of breaching integrity of control systems succeeds when the case stays open. The Belgian statement started out that way on day one. “May never be determined” is the Russian operational objective, as stated by the victim.
The same agencies attribute, so let’s think about the difference. The Dutch military intelligence service MIVD reported in April 2025 that a Russian hacker group had carried out a cyber sabotage attack on the digital control system of a public facility in the Netherlands, the first known case in the country, and that a second Russian operation against Dutch critical infrastructure looked like preparation for sabotage. Norway’s PST said in August 2025 that pro-Russian hackers had taken control of the Risevatnet dam in Bremanger in April through a weak password on a web-accessible control panel, opened a valve for four hours, and posted a video of the panel on Telegram the same day. A dam valve and a freezer setpoint belong to the same target class: an internet-facing industrial controller behind a weak credential, in a state that arms Ukraine.
The target class is Russian doctrine, to put it simply. Colonel Chekinov and Lieutenant General Bogdanov published a series in Military Thought from 2010 to 2017; their 2010 article on asymmetrical actions lists the civilian infrastructure where Russia should be able to inflict unacceptable damage in nonmilitary security areas, and their 2013 article on new-generation war names dams, nuclear plants and other infrastructure facilities as targets in the opening period of a conflict. UK Defence Intelligence read the strikes on Ukraine’s grid from October 2022 as the first attempt to run the Strategic Operation for the Destruction of Critically Important Targets, a doctrine built on hitting a state’s civilian infrastructure in place of its army to force its leaders to capitulate. The International Criminal Court issued warrants for Shoigu and Gerasimov in June 2024 for that same campaign, strikes on electric infrastructure from 10 October 2022 to at least 9 March 2023, as war crimes and the crime against humanity of inhumane acts. Food is absent from the target lists in the doctrine. Food is what spoils when the targets on the list go down, and a fridge controller is the shortest path to that result.
Food as the weapon itself was announced at the level of the Security Council. Medvedev wrote on 1 April 2022, five weeks into the invasion, that the food security of many countries depends on Russian supplies, that this is “a quiet but formidable weapon”, and that Russia would supply food and crops only to its friends. The Black Sea blockade followed, and the strikes on Ukrainian ports and grain storage after Russia left the grain deal in July 2023.
Logistics is where the Europeans get even more specific. Czech police concluded in April 2024 that officers of GRU Unit 29155 blew up the two ammunition depots at Vrbětice in October and December 2014, stock reported to be on its way to Ukraine. Polish prosecutors said in October 2024 that the parcels which ignited at the DHL hub in Leipzig on 20 July and the DHL warehouse near Birmingham on 22 July were sent to test a transfer channel for devices bound for the United States and Canada, and the head of MI5 described the GRU as on a sustained mission of arson and sabotage on British and European streets. That campaign ran on locally recruited disposable agents. A refrigeration campaign that needs a default password and a shopping list of exposed hosts runs on far less, and the December advisory says the groups pick targets exactly that way.
The threats we are talking about have a name in Russian military history. On 14 July 1943 the Central Headquarters of the Partisan Movement ordered Operation Rail War. It opened on the night of 3 August 1943 with tens of thousands of partisans striking the occupied rail network at once, which the Belarusian state war museum defines as simultaneous mass destruction of the enemy’s communications to disorganize his transport, timed to the Red Army offensive at the front. The second stage, Concert, began on 19 September and cut German rail transport in Belarus by 40 percent by the end of the year. The doctrine is one coordinated night, many cheap strikes, against supply, timed to something else. The night of 1 to 2 November has that shape across ten countries, and one of its strikes was aimed at a blood supply.
The evidence establishes a Russian state-aligned campaign against the civilian cold chain of states that are supporting survival of civilians in Ukraine.
The open question is the unit, and the agencies holding the logs will answer it when they decide the cost of saying so is lower than the cost of the next Russian victims. The October attack spoiled food. The November attack reached blood, although it was stopped by one technician who was awake. Or dare I say, woke.