Supermarkets and blood banks in the crosshairs: IoT refrigeration systems as a vector for attack
During the night of 2 November 2026, unknown individuals set the refrigeration systems at a supermarket in Reisbach, Lower Bavaria, to heat to 50 degrees. Shortly afterwards, supermarkets in North Rhine-Westphalia, Lower Saxony and Rhineland-Palatinate also reported that their systems had been tampered with. A single retailer in Lilienthal, near Bremen, had to dispose of goods worth over 360,000 euros. The cyber-attacks on IoT refrigeration systems began in mid-October in France, affecting hundreds of supermarkets. This was followed by incidents in Belgium, Sweden and the Netherlands, amongst others (heise online).
In early November, the healthcare sector was hit. At the French blood donation service EFS, attackers remotely tampered with the plasma cold stores at three sites. According to the newspaper *Le Canard Enchaîné*, the temperatures were set to rise from minus 30 to plus 110 degrees. The monitoring systems raised the alarm in good time, so all blood products remained undamaged (Handelsblatt).
Both cases follow the same pattern: The attacks targeted technology that many companies do not consider a security risk.
How cyberattacks on IoT cooling systems work
Modern cooling systems are networked. Service providers maintain them remotely, monitor temperatures and optimise energy consumption. It is precisely this connectivity that opens the door to attackers. Control systems and web-based management interfaces are often directly accessible via the internet, and automated scans can locate them quickly. It is not uncommon for them to be protected by nothing more than a default password.
Added to this is outdated technology. In France, according to the manufacturer, it was predominantly older control systems that were affected, some of which no longer receive security updates. Often, such systems are also connected to the same network segment as other operational technology (OT) or even the company’s IT infrastructure. A compromised refrigeration control system thus becomes a springboard into the rest of the network. Suppliers and service providers also increase the attack surface: in the case of the blood bank, the vulnerability lay in a third-party component.
What is striking is what the attackers were after. As things stand, it was neither data nor a ransom. They exploited standard functions such as setpoints, defrost mode and heating operation to cause physical damage. The BSI has issued an explicit warning against copycats, addressing operators of small and very small industrial installations in particular, such as cooling systems or solar inverters.
Facts
France, mid-October 2026: Hundreds of supermarkets affected, with temperatures reaching up to 50 degrees in some cases
Germany, early November 2026: incidents in four federal states, with over 360,000 euros’ worth of damage to goods in Lilienthal
EFS Blood Donation Service, early November 2026: Plasma cold stores at three sites tampered with, no damage to blood products
Perpetrator and motive: unknown; the police are investigating
BSI recommendation: BSI-CS 154 ‘Threats posed by internet-connected OT systems’
Siemens Simatic IoT2050: Why industrial gateways are particularly vulnerable
Industrial gateways such as the Siemens Simatic IoT2050 series connect production facilities to IT and cloud infrastructures. Anyone who gains control of such a gateway can often also access the systems behind it. The risk increases if devices are put into operation with their factory settings, updates are neglected, or the gateway is left exposed to the internet without an additional layer of protection.
A recent vulnerability illustrates just how real this threat is. In August 2026, Siemens published Advisory SSA-834709 regarding CVE-2026-58115, which has the highest CVSS score of 10.0. The affected model is the SIMATIC IoT2050 Advanced with Node-RED installed, whose web interface does not enforce authentication. This allows attackers to execute system commands without logging in. At the end of October, the security firm VulnCheck recorded the first attempts to exploit the vulnerability in its honeypots (SecurityOnline). It remains unclear whether any real devices have been compromised. As things stand, the vulnerability is not linked to the attacks on refrigeration systems.
Operators should update the firmware in accordance with the advisory. If this is not possible, Siemens recommends removing or securing Node-RED and restricting network access. The latest guidance has been published by Siemens ProductCERT.
How organisations can protect connected cooling and OT technology
Traditional IT security is not sufficient for connected infrastructure. The BSI-CS 154 recommendation focuses on three areas that have also proven effective in practice.
Check accessibility and secure access points
It all starts with a simple question: Which control systems are accessible via the internet? Direct access must be prevented. Remote maintenance should only take place via a VPN with multi-factor authentication; default passwords have no place in production systems. Devices without manufacturer support must be replaced or taken offline.
Segregate networks and identify devices
Cooling systems, gateways and components from service providers must be included in a central inventory. Only what is recorded can be patched and monitored. OT and IoT systems should be consistently separated from corporate IT so that a compromised device does not become a gateway into the entire network.
Detect tampering early
The EFS case shows that early detection determines whether damage occurs or not. A Security Operations Centre (SOC) detects unusual access attempts and implausible changes to setpoints in real time. Equally important is a contingency plan that specifies who does what in the event of an attack on OT systems and where critical assets are to be relocated in an emergency.
Medium-sized companies in particular, with small security teams, are rarely able to operate 24/7 monitoring cost-effectively themselves. External MDR or SOC services fill this gap.
Refrigeration technology belongs on the security agenda
Attacks on supermarkets and blood banks show that attackers are specifically targeting networked technology that nobody is keeping an eye on. Companies should therefore treat their refrigeration systems, control units and gateways in exactly the same way as any other system on the network: identify, secure and monitor them.
FAQ
How can organisations find out whether their cooling systems are accessible via the internet?
The first step is to draw up an inventory of all networked systems, including those managed by a service provider. After that, an external assessment can be carried out to determine which control systems and management interfaces are publicly accessible. Search engines for networked devices, such as Shodan, reveal what attackers can see. Those without their own security team can commission this assessment externally.
What should operators now ask their refrigeration service provider?
Four questions go a long way towards clarifying the situation: Is the control system directly accessible from the internet? Is remote access protected by two-factor authentication? Does the system still receive security updates? And who checks this regularly? If any of these questions remain unanswered, action is required. These questions are derived from the BSI recommendation BSI-CS 154.
What should be done with older systems for which updates are no longer available?
In the long term, they should be replaced. Until then, they must not be directly accessible from the internet. Remote access should only be permitted via a VPN with multi-factor authentication, and the system should be isolated from the rest of the network. Older devices in particular require close monitoring, as known vulnerabilities in them can no longer be patched.
How can you tell if a device has been tampered with?
Typical warning signs include unauthorised changes to setpoints, logins outside maintenance windows and unusual connections to the control system. Temperature alarms should be set up so that they trigger even if someone deliberately adjusts the system. Ideally, they should run via an independent channel. At the EFS blood donation service, it was precisely this monitoring that prevented the damage.
What should be done in an emergency?
Firstly, disconnect remote access, switch the system to manual mode and secure or remove any at-risk goods. Then back up settings and logs before anyone resets anything. Afterwards, report the incident to the police. For organisations covered by NIS2, additional reporting obligations may apply.