Entrar
Defrost and Disrupt | An Assessment of Europe’s Refrigeration Attacks
Executive Summary
On November 2 and 3, supermarket chains in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia reported overnight disruption to store refrigeration systems. The incidents came three weeks after attacks on refrigeration systems at hundreds of French supermarkets.
Attacks on refrigeration systems predate the 2026 incidents, including attacks on Russian supermarkets and Israeli stores documented by Danfoss in 2022, and a 2024 attack on a Los Angeles meat processor that the DOJ attributed to CARR.
Reporting and official statements suggest attackers changed temperature and defrost settings through the systems’ own management interfaces. ANSSI’s assessment of the French cases at the time pointed to internet-exposed administration interfaces and weak passwords.
Russian-aligned groups including CARR, NoName057(16) and Z-Pentest have a documented record of disrupting operational technology and have claimed refrigeration intrusions, making them a credible line of investigation. However, available evidence does not yet establish who is responsible for the European incidents.
Freezer failures at U.S. military commissaries in August predate the French attacks. U.S. officials reportedly suspect Iran-linked actors in those cases, an assessment that is provisional and does not concern Europe.
Further incidents are likely wherever the same access conditions persist. Copied techniques and opportunistic claims may make unrelated activity look like a single campaign before investigators establish whether one exists.
Overview and Chronology
Reporting on the recent spate of incidents affecting store refrigeration systems in Europe has moved quickly, at times conflating them with older attacks, hacktivist claims and government allegations about Russian and Iranian actors. The chronology below separates incidents from claims and from assessments. When reviewed in order, it shows similar incidents recurring across countries and months but does not establish that these various incidents belong to a single campaign.
2022 - Danfoss documented attacks targeting 16 Russian supermarkets and affecting 40 Israeli stores. According to the vendor, the affected Israeli installations lacked appropriate firewall or VPN protection.
November 2024 - A Los Angeles meat-processing facility suffered an attack that, according to later U.S. Justice Department allegations, spoiled meat and caused an ammonia leak. The DOJ attributed that incident to CyberArmyofRussia_Reborn, or CARR.
December 9, 2025 - The DOJ announced allegations of Russian government backing for CARR and NoName057(16). A concurrent multinational advisory documented associated groups’ opportunistic attacks against operational technology.
Late August–September 1, 2026 - Refrigeration failures affected at least six U.S. military commissaries, the grocery stores serving military personnel. By September 1, Stars and Stripes had reported that three military criminal-investigation agencies were investigating. Their involvement was therefore public well before October’s reporting about suspected hacking.
October 11–13, 2026 - Hundreds of French supermarkets experienced refrigeration disruption. The Paris prosecutor’s cybercrime section opened an investigation the same day, and on October 13 Economy Minister Roland Lescure told Parliament that approximately 700 stores had been affected. CERT-FR issued its alert on October 12 and expanded the affected-equipment list on October 13. It encompasses Danfoss AK-SM and AK-SC equipment alongside Copeland and Dixell XWEB systems.
October 21, 2026 - ANSSI director Vincent Strubel told the French Senate that the agency’s assessment at the time pointed to exposed administration and weak passwords, rather than the previously publicized vulnerabilities discussed in early coverage.
October 29, 2026 - Reuters reported, citing four officials, that the Pentagon was treating the August commissary failures as suspected hacking. Separately, Nextgov/FCW reported that officials suspected Iran-linked actors, citing two people familiar with the matter. The Iran assessment was provisional and concerned the U.S. cases, not the European incidents.
November 2-3, 2026 - Further refrigeration incidents were reported in Belgium, Estonia, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. In Finland, Kesko also reported temperature anomalies at a few smaller stores and said it was investigating the cause, without ruling out interference over the network.
Update November 4, 2026 - Subsequent reporting has reproduced claims attributed to NoName057(16) and Z-Pentest concerning the European refrigeration attacks. A circulated video names Danfoss and Dixell XWEB equipment, while a separate NoName-attributed post alleges possession of employee and customer credentials associated with Danfoss. These claims have not been independently verified and do not establish that the alleged credentials enabled the refrigeration incidents, or that the reported attacks share a single operator. We would like to thank our colleagues at DSCO for their collaboration on this work.
The German reporting illustrates the distinction between incident dates and disclosure dates. WDR reported affected stores in North Rhine-Westphalia on November 2, while BR’s November 3 report described manipulation at an Edeka store in Reisbach overnight into November 2.
Our chronology shows that refrigeration attacks predate the current wave. Danfoss documented attacks on Russian and Israeli stores in 2022, and the DOJ attributed the 2024 Los Angeles meat-processing incident to CARR.
The U.S. commissary failures came before the French attacks. Reuters reported on October 29 that the Pentagon was treating those failures as suspected hacking and that U.S. and French investigators were coordinating, although that does not establish a common perpetrator. By that time, the outages were two months old, and military investigators’ involvement had been public since September 1.
Further, while Russian-linked activity and the Iran suspicion appear in the same chronology because both are part of the public record on these incidents, they concern different actors and different incident clusters. The Russian-linked entries are precedent from 2024 and 2025, and the Iran suspicion relates only to the U.S. commissary cases.
Suspected Attack Method
These incidents involve commercial supervisory platforms that centralize management of refrigeration equipment across a site, letting operators monitor equipment, adjust settings, review alarms and perform maintenance remotely. An attacker who gains control-capable access to the management interface can change operational settings and push refrigeration outside its intended conditions.
How attackers reached those interfaces is a separate question; however, early coverage focused on published vulnerabilities in Danfoss controllers, including authentication-bypass and command-injection flaws documented in Claroty’s research. On October 21, ANSSI director Vincent Strubel told a French Senate hearing that, according to the agency’s assessment at the time, those vulnerabilities were not the ones exploited, pointing instead to exposed administration and weak passwords.
ANSSI’s assessment covers the French cases, and it is not yet known whether the same access path applies to the November 2-3 incidents or the U.S. commissaries. The documented vulnerabilities remain a risk for any operator running unpatched or end-of-life controllers.
Attribution
Responsibility for the European incidents has not been publicly established. Russian-aligned disruptive actors are one credible hypothesis, based on precedent shown in the chronology, including the DOJ’s allegations about CARR and NoName057(16) and its attribution of the 2024 Los Angeles incident to CARR.
Notably, SentinelLABS has previously documented how NoName057(16) organizes and publicizes its DDoS operations against Ukraine and NATO countries.
The multinational advisory published alongside the DOJ’s allegations assessed that CARR administrators and a NoName057(16) administrator went on to form Z-Pentest after dissatisfaction with GRU support, and that Z-Pentest operates separately from GRU involvement.
DOJ’s December 9 announcement, summarizing the indictments, instead describes CARR as “also known as Z-Pentest.” These public descriptions do not fully resolve the relationship between the groups or the extent of state direction over particular operations. Neither establishes responsibility for the current refrigeration incidents.
Z-Pentest has since claimed a refrigeration intrusion. An archived Telegram repost attributed to the group describes a purported joint operation with NoName057(16) against refrigeration controls at a Spanish supermarket, claiming access that would allow changes to temperatures and equipment operation. The repost survives in a third-party archive and confirms neither access nor damage, nor any link to the current attacks.
Independent ideological operators, copycats, financially motivated intruders and other state-linked actors also fit the public facts, as does Iran-linked involvement in the U.S. cases, where officials’ suspicion remains unverified.
Moving past these hypotheses would require evidence tying affected environments to an operator, such as access records, infrastructure with meaningful provenance, distinctive sequences of configuration changes, validated account activity, or actor material containing verifiable details that weren’t already public. A familiar target, a shared controller model or a similar temperature change would not be enough, because there are only a limited number of obvious ways to disrupt the same equipment.
Investigators may hold evidence of this kind that has not been released. Without it, outside observers cannot yet independently substantiate a specific attribution.
Targeting and Motivation
Under a Russian-aligned scenario, these attacks could serve both disruptive and influence objectives. Visible interference with familiar civilian services can impose costs in countries supporting Ukraine and convey that ordinary services remain within reach, a message that requires no threat to the food supply itself.
Individual targets may also have been chosen for a simpler reason, which is that the systems were accessible. The joint advisory describes pro-Russia groups as selecting victims on superficial criteria such as availability and existing vulnerabilities, so a disruption with strategic value need not involve a strategically chosen target.
The “hacktivist” label describes how such groups present themselves and is not a reliable guide to their capability, independence or potential for harm.
Nonetheless, ambiguity of motivation is sometimes an objective. Beyond undermining domestic faith in governments, this is a relatively low resource intrusion that can produce expensive, irreversible consequences to everyday people.
Outlook
Further attempts are likely wherever the same access conditions persist. Industry and government organizations have warned that the cheap, repeatable techniques used by pro-Russian groups can be adopted by others, and the suspected method needs little beyond access, so continued activity could involve previous operators, unrelated groups or both.
New victims and opportunistic claims can make unrelated activity look like a single campaign before investigators establish whether one exists. Similar outcomes already have more than one suspected actor, with Russian-aligned groups a credible hypothesis for the European cases and Iran-linked actors provisionally suspected in the U.S. cases.
Shared maintenance access deserves scrutiny. Portugal’s Mosqueteiros group said incidents at seven Intermarché stores appeared to target an external provider responsible for refrigeration management. In Germany, an operator also described an attack involving its refrigeration-maintenance company. These accounts make third-party access an important investigative lead, but do not establish one compromised provider, a common intrusion path across countries, or a compromised software-update channel.
Portugal’s Mosqueteiros group said the incidents at seven Intermarché stores appeared to involve an external provider responsible for refrigeration management. In Germany, an AWO representative also described an attack involving the company remotely maintaining an affected store’s refrigeration. These operator accounts make third-party access an important investigative lead, but do not establish one compromised provider, a common intrusion path across countries, or a compromised software-update channel. Investigators should examine whether accounts, gateways or administrative infrastructure connect multiple affected locations.
Mitigation Guidance
Where safely practicable, preserve relevant logs and configuration records before restarting or resetting equipment. Coordinate recovery with refrigeration personnel, prioritizing physical safety and safe operating conditions.
CERT-FR’s alert on the French incidents sets out steps for operators of the affected Danfoss, Copeland and Dixell equipment. It calls for removing those units, and any other equipment on a public IP address, from internet exposure, checking insurance terms first if doing so cuts the data feed to the refrigeration contractor, and reviewing the complete configuration, defrost ranges in particular. It advises restoring access only through a secure VPN or protected network, with firewall filtering of contractors’ source addresses acceptable only as a stopgap, and applying the manufacturer’s hardening guidance, such as firmware updates and changed default passwords.
For compromised units, it advises a restart or factory reset followed by reconfiguration, and it warns that a reset alone will not prevent re-compromise of an end-of-life device that stays exposed.
The December 2025 joint advisory from the FBI, CISA, NSA and international partners addresses its mitigations to OT owners and operators generally. It recommends scanning owned IP ranges for exposed systems, including connections set up by third parties, segmenting IT from OT networks, using MFA where possible and strong, unique passwords where it is not, and limiting remotely accessible accounts to view-only. It also recommends reviewing setpoint ranges with alerting for deviations, keeping backups of controller configurations, and practicing manual operation.
For exposed systems with weak or default credentials, the advisory says to assume compromise. Its response steps include isolating affected hosts, scoping the intrusion by reviewing unusual authentications and recent network connections, issuing new credentials and reporting the compromise to the relevant authorities.
Conclusion
Attacks on retail and food-industry refrigeration predate the 2026 incidents, with Danfoss documenting cases at Russian and Israeli stores in 2022 and the DOJ attributing a 2024 attack on a Los Angeles meat processor to CARR.
In the French cases, ANSSI’s assessment at the time pointed to exposed management interfaces and weak passwords, conditions that guidance from CERT-FR and the joint advisory addresses directly.
The public record does not yet establish who was responsible for the European incidents or whether they form a single campaign. Further incidents are likely wherever the same access conditions remain.
