Attackers disrupt refrigeration systems at European supermarkets

Unit 42 reports that cyberattacks targeting refrigeration systems in Europe began at least by October 2026, with unauthorized access to refrigeration controllers and defrost mode being used to spoil food in hundreds of supermarkets across the region. The first wave occurred overnight October 11–12, 2026 and primarily hit around 700 supermarkets in France. A subsequent wave overnight November 1–2, 2026 expanded across at least 10 more European countries and affected over 100–115 retail locations.

French authorities noted that refrigeration systems used by medical facilities were also impacted, though there is no evidence that blood products were spoiled. Threat actors reportedly raised the temperature of targeted units to as high as 50°C (122°F), with some incidents triggering fires. The initial access vector remains unconfirmed, but there is broad speculation that devices were running vulnerable software versions or used default credentials.

Unit 42 identified more than 5,000 internet-exposed devices from manufacturers cited in the CERT-FR advisory as of 5–6 November 2026. The analysis notes that this exposure does not necessarily indicate exploitability, but figures illustrate the scale of exposure by country, with France accounting for the majority of cases. The team tracked a downward trend in internet-exposed devices in France from October through November 2026: 1,853 (Oct 1–15), 558 (Oct 16–31), and 316 (Nov 1–6).

NoName057(16) and Z-Pentest claimed responsibility via Telegram on November 3, 2026, though claims remain unverified. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on November 5, 2026 warning of potential exploitation via authentication bypass, arbitrary code injection, and weak configurations. Cortext Xpanse data supports exposure patterns observed during this period.