Attackers have been reaching into commercial refrigeration controllers across Europe and forcing them into defrost mode, and US agencies have issued a fact sheet warning of malicious activity against industrial refrigeration and cold chain monitoring systems globally. The fact sheet does not mention the European incidents; the link to this campaign is Unit 42’s framing. Unit 42 published an overview of the campaign on November 6; CISA, the FBI, HHS, USDA and DoT published their fact sheet on November 5.
What Happened
According to Unit 42, which says its account is based on public reporting, the first wave hit overnight on October 11-12, 2026 and primarily targeted about 700 supermarkets in France. A second wave on the night of November 1-2 reached at least 10 additional European countries and affected over 100 to 115 retail locations, per Unit 42. Unit 42 also relays that French authorities have disclosed that refrigeration systems at medical facilities were affected, and states there is no evidence that blood products were spoiled.
Unit 42, citing unnamed public reports, says the attackers raised temperatures in targeted units as high as 50°C (122°F), and in some cases the activity resulted in fires. Hundreds of supermarkets had to discard spoiled food.
Attribution and Access Vector
On November 3, the pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility via Telegram. Unit 42 describes those claims as unverified, and we have not seen independent confirmation. The initial access vector is also unconfirmed; Unit 42 notes widespread speculation about vulnerable software versions or manufacturer default credentials.
CISA’s fact sheet is more specific about what actors “may” exploit: authentication bypass, arbitrary code injection and weak configurations in electronic temperature controllers and commercial refrigeration controllers at retail grocery and cold storage sites. It lists possible effects as changed temperatures (with fire and spoilage risk) and loss of temperature visibility. No actor is named in the fact sheet (opened 9 Nov 2026).
Exposure Data
Using Cortex Xpanse, Unit 42 counted more than 5,000 internet-exposed devices from manufacturers listed in a CERT-FR alert of 12-16 October, counted on November 5-6. That alert names Danfoss AK-SC and AK-SM, and Copeland and Dixell xweb, devices. Unit 42 cautions that this does not mean those devices run vulnerable software. Exposed devices in France fell from 1,853 (October 1-15) to 558 (October 16-31) and 316 (November 1-6); the periods are 15, 16 and 6 days long, so the counts are not like-for-like.
What Defenders Should Do
CISA’s recommended actions include:
- Remove controllers from direct internet exposure; where remote access is needed, place it behind an updated firewall or edge device.
- Put OT devices on a dedicated VLAN, change default passwords and use phishing-resistant MFA where feasible.
- Patch firmware and retire end-of-life devices.
- Allowlist the devices and IP addresses permitted to change settings.
- Define safe setpoint ranges for downstream equipment and alert on deviations.
- Keep offline backups, enable logging and review it.
Our Assessment
This is a physical-impact OT campaign against a sector that, in our reading, gets little attention in threat reporting, arriving ahead of the holiday retail peak (Unit 42 calls the timing particularly concerning). Our inference is that the falling count of exposed French devices reflects operators acting, but the second wave shows that exposure elsewhere remains. Attribution should be treated as open until a government or vendor source confirms it.