A series of coordinated cyberattacks targeting industrial refrigeration systems across Europe has caused significant operational disruptions, leading to widespread food spoilage and safety concerns. The campaign, which began in mid-October 2026, has expanded from an initial focus on French supermarkets to affect at least 10 other European countries. While the primary impact has been on the retail sector, French authorities have confirmed that medical facilities, including blood banks, were also targeted, though there is currently no evidence that sensitive medical supplies were compromised.
The attacks involve unauthorized access to refrigeration controllers, which threat actors have manipulated to enter defrost mode or raise internal temperatures to as high as 50°C (122°F). In some instances, the extreme heat generated by these forced malfunctions has resulted in physical fires at retail locations. The first wave of activity occurred overnight between October 11 and 12, 2026, affecting approximately 700 supermarkets in France. A subsequent wave, occurring between November 1 and 2, 2026, impacted more than 100 additional retail sites across the broader European region.
While the exact method of initial access remains unconfirmed, security researchers and government agencies suspect that the attackers are exploiting vulnerable firmware versions or taking advantage of default manufacturer credentials left unchanged by operators. On November 5, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory warning that the attacks may involve authentication bypass, arbitrary code injection, and the exploitation of weak device configurations.
On November 3, 2026, two pro-Russian hacktivist groups, NoName057(16) and Z-Pentest, claimed responsibility for the incidents via Telegram. These claims have not been independently verified, and authorities continue to investigate the attribution of the campaign.
Security analysis indicates that thousands of internet-exposed refrigeration devices remain vulnerable. Researchers monitoring the threat landscape identified over 5,000 devices globally that were manufactured by companies previously flagged in a CERT-FR advisory. However, there has been a notable decline in the number of exposed devices in France since the onset of the attacks, suggesting that some organizations have begun to secure their infrastructure. Exposure counts in France dropped from 1,853 in the first half of October to 316 in early November.
The ongoing nature of these attacks has prompted a push for better visibility into operational technology (OT) and internet-of-things (IoT) environments. Security experts recommend that organizations conduct continuous discovery of internet-facing assets to identify exposed administrative interfaces and anomalous control-plane traffic. Furthermore, the implementation of virtual patching is being suggested as a critical defense measure, allowing operators to shield unpatched firmware from exploitation attempts without the need to take physical systems offline for manual updates.
As the holiday shopping season approaches, the risk to retail inventory remains a primary concern for the industry. The combination of potential physical damage to equipment and the loss of perishable goods has highlighted the vulnerability of critical infrastructure that is increasingly connected to the public internet. Organizations are being urged to audit their configurations, enforce strict access controls, and monitor for command-and-control communication as the investigation into these refrigeration system compromises continues.
