Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System
Unidentified cyberattacks have compromised refrigeration systems across Europe, forcing supermarkets to discard spoiled food and raising concerns about critical infrastructure security.
Cyberattacks targeting refrigeration systems have disrupted operations across Europe, with hackers gaining unauthorized access to controllers and setting them to defrost mode. The attacks have resulted in hundreds of supermarkets discarding spoiled food, with the timing particularly concerning as retailers prepare for increased holiday shopping.
The first wave occurred overnight between October 11-12, 2026, primarily targeting approximately 700 supermarkets in France. A second wave between November 1-2 expanded to at least 10 additional European countries, impacting over 100 retail locations.
Attack Details
According to multiple sources, the threat actors raised temperatures in targeted refrigeration units as high as 50°C (122°F), causing some units to catch fire. French authorities have also disclosed that medical facilities' refrigeration systems were compromised, though there's no evidence blood products were spoiled.
The initial access vector remains unconfirmed, though widespread speculation suggests impacted devices may have been running vulnerable software versions or using default credentials that attackers easily identified.
Exposed Devices
From November 5-6, researchers identified over 5,000 internet-exposed devices manufactured by companies listed in a CERT-FR advisory. In France, the number of exposed devices has significantly declined from 1,853 in early October to just 316 by early November.
The time of year when this activity has occurred is particularly concerning since retailers need to maintain adequate inventory levels as shoppers ramp up spending during holiday periods.
Responsibility and Response
On November 3, pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility via Telegram posts, though their allegations remain unverified. The Cybersecurity and Infrastructure Security Agency (CISA) subsequently released an advisory warning of potential exploitation through authentication bypass and arbitrary code injection.
Palo Alto Networks has outlined several products and services to help organizations identify and defend against similar threats, including continuous discovery of exposed devices and virtual patching capabilities to block exploit attempts in real time.
Related
