After fridges in supermarkets, blood donation services have now also been attacked by unknown hackers. Because the cooling was interrupted, donations have become unusable. In an interview with Euronews, an ethical hacker explains how they try to find security gaps before criminals can use them to cause damage.
“In the past two weeks we have seen an exceptional concentration of spectacular cases of a kind we would previously not have experienced even over the course of an entire year,” explains Marco Di Filippo, a cybersecurity expert at Whitelisthackers. He is what is known as an ethical hacker and is hired by companies to test their IT security.
Recently he has been kept busy by many incidents, from the AfD leaks to security vulnerabilities at Revolut and in the PHP scripting language, which is used to build numerous websites, through to attacks on cold stores. In 2025, according to the Federal Criminal Police Office’s Cybercrime Situation Report 2025, economic damage of 202.4 billion euros was recorded.
A single click opened the door for hackers into Berlin’s state network
Speaking about the cyberattack on Berlin’s state network in August 2026, Di Filippo said it was a particularly problematic case. It could have been avoided. The perpetrators demanded a ransom of 30 bitcoin (around 2 million euros), but the Berlin senate consistently refused to pay. In the end, 1.4 million confidential files were published on the darknet.
The reason was a weakness in the digital system. The ransomware group “Rhysida”, which was behind the attack, exploited a person’s lack of knowledge. “The victim was lured to a website and asked to confirm there that they were a human being. This attack method is called ClickFix. People know this, you have to enter numbers, put together images or solve a calculation to confirm that you are not a bot,” explains Di Filippo.
On the website, the victim was asked to carry out a specific key combination, paste in a command and press Enter. “By doing that, they ultimately opened the door for the attackers themselves,” comments Di Filippo. According to the IT security expert, it is as if you were to write an email with the following content: ‘I want to rob a bank and I will come by at ten o’clock this evening. Please leave the door ajar so that I can go straight to the safe.’
For Di Filippo, two lessons can be drawn from this case. On the one hand, there was a lack of attention: “First, there was a user who executed this command, the human factor.” In addition, the user should never have had the rights needed to carry out such an attack. “We see cases like this every day where all you can do sometimes is shake your head,” says Di Filippo.
Humans as the weak point in IT security
The likelihood of being affected by a hacker attack is one in two. Yet this is still underestimated today, according to cybersecurity expert Marco Di Filippo from Whitelisthackers. Instead, people are more afraid of burglaries or thunderstorms. “The probability of being struck by lightning is just 1 in 200,000,” says Di Filippo.
The cybersecurity expert laments that security is not a priority these days. “A lot of products are sold where usability, user friendliness, is the focus,” he explains. For example, there are smart homes, where lights and heating can be controlled from anywhere. Fridges in supermarkets are also connected to the internet so they can be managed centrally. Everything is becoming easier, but not necessarily safer.
“And this is exactly where we have a deficit in our education today. By ‘we’ I mean all of us, that is everyone who has never learned to recognise the dangers,” says Di Filippo. Education is where we need to start. Anyone who has never been exposed to the risk of a hacker attack does not see themselves as a potential target. Yet the opportunities to, for example, log into other people’s devices are increasing all the time.
Why cybersecurity starts with education
In some cases, simply clicking on a link in an SMS or WhatsApp message, after which you are asked to confirm your identity, is enough to unintentionally give attackers access to private messages. Attackers link themselves to the device and in this way gain access to messages, media and contacts. The Federal Office for Information Security (BSI) warned of this method, which is known as “ghost pairing”, at the beginning of this year. To prevent strangers from reading along, incoming messages should, according to the BSI, be “critically examined” and mechanisms such as two factor authentication should be set up.
Other countries like India, for example, are carrying out a lot of awareness raising in addition to developing technology. “When I travel on the underground in India, I see posters everywhere, cybercriminals or cyber damage with a hotline I can call,” says Di Filippo. In Germany, on the other hand, people are sometimes turned away by the police and have to search for which authority is responsible.
“There are new angles and ideas for attacks every day,” Di Filippo warns, referring to rapid developments. “With the fridges, hackers discovered this one security gap once and now they just have to see who has this kind of model in operation. The attacks then spread accordingly.” Finding a security gap can trigger a snowball effect.
In around 80 to 95 percent of attacks, however, people are always involved in allowing a gap to be exploited, according to Di Filippo, as in the attack on Berlin’s state networks. “We therefore have to focus very strongly on education and awareness (editor’s note: “awareness”) so that we ultimately become resilient to cyberattacks. The human factor has to be included, we cannot manage it with technology alone.”
Hacking in order to stop hackers
In his work, the aim is to put himself in the shoes of criminal hackers. “Ultimately, we try to attack infrastructures or find flaws in infrastructures in software or IT based devices. Using the same tools that real cybercriminals use,” says Di Filippo. “The difference is that our goal is to find the flaws before real attackers do and exploit these gaps.”
The important difference is that ethical hackers are commissioned by clients, for example large companies, and the hackers do not want to cause any damage to those clients’ infrastructure. No one at his company has ever had a criminal background, Di Filippo stresses. Ethical hackers have to present a police clearance certificate to disclose and prove their past.
“We always find a security vulnerability,” he told Euronews when describing his work. In the end, his team provides companies with a report of up to 400 pages detailing where the gaps in their digital infrastructure are and how they were found.
Once a vulnerability has been found, the manufacturers of devices or systems are notified and can then work with the company to close the gap. In individual cases, these vulnerabilities, for example on the iPhone, are worth several million euros. “We then wait until the gap has been closed. Each vulnerability is subsequently published via a so called CVE,” says Di Filippo.
A CVE stands for Common Vulnerabilities and Exposures. It is a catalogue of security vulnerabilities that is publicly accessible. The BSI itself also provides information about vulnerabilities and, for a broader collection, officially refers to the international National Vulnerability Database (NVD).
When missing encryption can cost billions
The stories Di Filippo can tell sound like the script for a Netflix series. Around a decade ago, for example, there was a case in which cybercriminals were able to steal 1.2 billion euros from a bank relatively easily. “And that was because at the time the bank had no security measures at all for networking its locations,” says the cybersecurity expert.
According to reports, the bank had one branch on one side of a street and another associated office directly opposite. “They connected this location with a directional radio link and this link was not encrypted. Attackers, without any hacking skills at all, were able to log in very easily and move around the bank digitally, so to speak, and quietly and secretly steal this money.”
In some cases, fridges in supermarkets also ultimately lacked protection in the form of encryption. Experts recommend at least using a VPN or a firewall. Higher security standards now apply to banks. Just under a year ago, the federal government also adopted the NIS 2 directive. It obliges significantly more companies and sectors than before to implement binding cybersecurity measures, in particular preventive ones.
The company Whitelisthackers also relies on media literacy and has therefore launched the competition “Germany’s best hacker”. The aim is to find talent and, with the help of ethical hackers, make the digital world safer. The winners are allowed to take part in international so called hackathons, hacking in marathon style.
Hacking as a service is booming on both sides. In the darknet, Cybercrime as a Service (CaaS) (in German: “Cyberkriminalität als Auftragsarbeit”) is now widespread among criminals, but the legal market for security services is also growing. Whitelisthackers handles the orders of around 250 clients a year. After the spectacular, in some cases global, incidents, companies are increasingly interested in improving their own security infrastructure.
