Turning Up the Heat: How Pro-Russian Hacktivists Took Down Europe's Cold Chain in 2026
Turning Up the Heat: How Pro-Russian Hacktivists Took Down Europe's Cold Chain in 2026
Beginning overnight on October 11–12, 2026, unidentified threat actors—later claimed by pro-Russian hacktivist groups NoName057(16) and Z-Pentest—compromised internet-exposed industrial refrigeration controllers across Europe, forcing units into defrost mode and raising temperatures as high as 50°C (122°F). Approximately 700 French supermarkets were impacted in the first wave, with a second wave on November 1–2 expanding to over 100 locations across at least 10 additional countries. Initial access likely exploited vulnerable firmware versions and default manufacturer credentials. Physical consequences included mass food spoilage, fires, and disruption to medical facility refrigeration systems. Unit 42 identified more than 5,000 affected-manufacturer devices still exposed to the internet as of November 5–6, 2026.
This incident underscores the escalating weaponization of ICS/OT infrastructure by hacktivist actors aligned with geopolitical agendas. As operational technology converges with internet-connected environments, attacks on cold-chain and critical-supply infrastructure are becoming a preferred vector for state-adjacent groups seeking measurable, real-world disruption without formal military attribution.
Critical impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Hackers Are Targeting Your Refrigerators: FBI & CISA Sound the Alarm on ICS Cold-Chain Attacks
In November 2026, the FBI, CISA, HHS, USDA, and DOT issued a joint advisory warning that threat actors are actively exploiting unpatched or internet-exposed electronic temperature controllers and commercial refrigeration management systems across healthcare, food production, chemical, and transportation sectors. Attackers leverage authentication bypass vulnerabilities and arbitrary code injection flaws to remotely alter temperature settings, force continuous defrost cycles, and suppress operator visibility—causing food spoilage, equipment damage, fire hazards, and unsafe blood-product storage. The warning followed confirmed attacks on an estimated 250–350 French supermarkets and a French Blood Establishment facility where stored blood products were placed at risk.
This advisory reflects a broadening ICS/OT threat landscape where operationally critical but historically under-secured devices—such as refrigeration controllers—are now primary targets. The convergence of IT and OT networks, combined with internet-exposed legacy devices running default credentials, has lowered attacker barriers significantly, signaling an urgent need for OT-specific zero trust segmentation and network visibility strategies.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
One Vulnerability, 700 Stores: How Europe's Freezer Hacks Exposed the Hidden Risk of Shared OT Infrastructure
On the night of October 11, 2026, an unknown threat actor compromised refrigeration control systems—specifically Danfoss AK-SM/AK-SC controllers and Copeland/Dixell XWEB systems—used by hundreds of French supermarkets, triggering extended defrost cycles that spoiled food, damaged equipment, and reportedly started fires across roughly 700 stores. The attack exploited internet-accessible OT devices running default credentials and unpatched legacy firmware, enabling the same technique to be replicated across borders into Belgium, Estonia, Germany, Ireland, Luxembourg, the Netherlands, Poland, Portugal, Spain, and Sweden within weeks. Total damages ran into the millions of euros and a near-simultaneous attack targeted French blood-bank refrigeration units, narrowly avoiding destruction of blood plasma.
This incident underscores a maturing attacker playbook targeting shared OT infrastructure: when dozens of retailers deploy the same controller model, same remote-access pattern, and same default credentials, a single reconnaissance sweep yields hundreds of targets. CERT-FR's post-incident advisory and parallel EU grocery-sector warnings signal growing regulatory and sector-level pressure to treat food-cold-chain OT as critical infrastructure.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
When Hackers Target Blood: The 2026 EFS Refrigeration Cyberattack and the OT Supply-Chain Crisis
On November 2, 2026, France's national blood service (Établissement français du sang, EFS) suffered an indirect cyberattack when threat actors exploited a vulnerability in third-party remote monitoring software used by refrigeration supplier Coolworld Rentals. The attackers manipulated temperature and defrost settings across cold-storage chambers at three EFS facilities, threatening plasma bags and biological samples. EFS monitoring systems detected the anomaly rapidly, enabling staff to transfer or secure all products; no blood loss or health impact was reported. ANSSI and the French Ministry of Health are actively investigating. This incident is part of a documented wave of ICS/OT attacks targeting refrigeration controllers across Europe—including more than 465 retail cold-chain sites struck in October–November 2026—exploiting Danfoss and Dixell XWEB remote management interfaces (CVE-2025-41450, CVE-2025-41451). The pattern confirms that OT supply-chain compromise via internet-exposed third-party remote monitoring components is an escalating, cross-sector threat with direct life-safety consequences.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Cold-Chain Under Attack: How Two Waves of ICS/OT Sabotage Exposed Europe's Refrigeration Security Gap
In October and November 2026, an unknown threat actor executed two successive waves of cyberattacks against Internet-connected commercial refrigeration controllers at hundreds of European supermarkets across France, Belgium, Germany, the Netherlands, Portugal, Poland, Spain, Luxembourg, Estonia, Ireland, Sweden, and Finland. Attackers exploited unpatched firmware vulnerabilities and default credentials in controllers manufactured by Danfoss, Dixell, and Copeland—forcing systems into defrost mode at 50°C (122°F) and triggering widespread food spoilage. The first wave impacted over 700 stores; the second struck dozens more. No group has claimed responsibility, and European authorities are actively investigating.
These incidents underscore a worsening pattern of ICS/OT sabotage targeting Internet-exposed operational technology with poor security hygiene. As threat actors increasingly leverage automated scanning, credential stuffing, and known CVEs against legacy OT devices, the attack surface extends far beyond retail—threatening pharmaceutical cold storage, food distribution, and industrial temperature-control systems globally.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Hackers Turned Up the Heat: How Europe's Supermarket Fridges Became an ICS/OT Battleground
In the early hours of November 2, 2026, threat actors remotely manipulated industrial refrigeration controllers across supermarkets in Belgium, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal, and Italy. Attackers exploited internet-exposed Danfoss AK-SM and AK-SC series controllers—many running outdated firmware with default credentials and no VPN protection—switching units into defrost mode or raising setpoints to 50°C. Dozens of stores across chains including Delhaize, Carrefour, ICA, Coop, and SuperValu were forced to discard or pull chilled and frozen goods, with one Belgian butcher estimating €15,000 in losses. The attack mirrored a nearly identical campaign against hundreds of French supermarkets three weeks prior.
This second wave confirms that ICS/OT attacks on retail cold-chain infrastructure are becoming a repeatable, scalable playbook. Attackers require no sophisticated zero-day—only internet-exposed legacy controllers with default passwords. As regulators across the EU accelerate NIS2 enforcement and critical-infrastructure owners expand OT connectivity, the window for unprotected industrial devices to be weaponized for economic disruption is widening rapidly.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Cold Chain Under Attack: How Hackers Shut Down Refrigerators Across Europe's Supermarkets
In November 2026, threat actors remotely exploited vulnerabilities in industrial refrigeration controllers—specifically Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB units—to manipulate temperature settings across more than 115 supermarket locations in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Attackers activated defrost functions and raised freezer temperatures to as high as +50°C overnight, forcing emergency food disposal and the deployment of refrigerated trucks. Over a dozen retail chains were impacted, including Ahold Delhaize, Carrefour, Coop, ICA, and SuperValu. The attack vector was attributed to the same unpatched vulnerability exploited in a comparable campaign targeting French supermarkets the prior month, with refrigeration vendor Sabcobel identified as a common technology supplier across affected sites.
This incident follows a documented escalation in ICS/OT-targeted attacks against civilian critical infrastructure—specifically cold-chain and food-retail systems. As operational technology converges with internet-connected management platforms, the attack surface for remote exploitation expands dramatically, and the consequences move beyond data loss into tangible physical and economic harm.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Frozen Out: How Unpatched Fridge Firmware Burned 700 European Supermarkets
In October 2026, attackers exploited unpatched firmware vulnerabilities in commercial refrigeration controllers — specifically CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 in Danfoss AK-SM 800A, as well as 23 flaws in Dixell/Copeland XWEB Pro — to sabotage refrigeration systems across more than 700 European grocery stores in a single night. Threat actors gained remote access via third-party service providers managing legacy OT equipment, manipulated defrost cycles to disguise the attack as routine maintenance, and forced temperatures above 50°C, destroying perishable inventory and triggering minor fires. Intermarché alone reported tens of millions of euros in losses, with impacts spanning France, Spain, Portugal, Poland, Germany, and Belgium. Attackers accessed systems through unmonitored third-party OT vendor connections on internet-exposed controllers running end-of-life firmware dating to 2016.
This incident signals a sharp escalation in ICS/OT sabotage targeting civilian food infrastructure. With thousands of Danfoss systems still internet-exposed and researchers having published exploit details just weeks before the attack, the gap between vulnerability disclosure and weaponization is closing dangerously fast — raising urgent questions about third-party OT access governance across critical supply chains.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
AI Breached an OT Network and Moved a Robotic Arm in 16 Minutes—Here's What That Means for Critical Infrastructure
In October 2026, Booz Allen Hamilton published findings from controlled laboratory testing in which frontier commercial AI models successfully compromised a mock OT/ICS environment in as little as 16 minutes. Starting at the perimeter firewall, the AI agent traversed IT network layers, identified misconfigured OT devices, penetrated a SCADA system, and ultimately actuated a robotic arm—achieving all eight predefined attack objectives. The speed of compromise was the critical finding: security-through-obscurity assumptions that have long protected OT environments were rendered ineffective by AI's ability to rapidly map unfamiliar industrial networks and chain exploits autonomously.
This research signals a structural shift in OT/ICS threat modeling. AI-augmented attacks democratize adversarial capability, eliminating the need for deep OT domain expertise. With 70% of industrial operators already integrating AI into operations, the attack surface is expanding simultaneously from within and without, compressing defender response windows to sub-human timescales.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
European Grocery Chains Hit by Massive Refrigeration System Cyberattack
In October 2026, cybercriminals exploited unpatched vulnerabilities in Danfoss and XWEB refrigeration controllers across over 400 European grocery stores, converting refrigerators and freezers into heating units that reached 50°C (120°F). The attackers manipulated defrost cycles to mask the sabotage, causing complete spoilage of perishable inventory and estimated losses exceeding several million euros. The attacks leveraged CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 affecting end-of-life Danfoss AK-SM 800A platforms, along with 23 vulnerabilities in XWEB Pro systems disclosed by Claroty researchers in August 2026.
This incident highlights the growing threat to operational technology (OT) environments where legacy industrial control systems remain Internet-exposed and unpatched. As critical infrastructure increasingly relies on connected IoT devices for remote monitoring and control, attackers are shifting focus from traditional IT networks to industrial systems that can cause immediate physical and financial damage.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
French Supermarket Cyberattack Exposes Critical IoT Security Gaps in Connected Refrigeration Systems
In October 2026, cybercriminals targeted connected refrigeration systems across French supermarket chains, exploiting vulnerabilities in older Danfoss IoT units that could not receive security updates. Attackers gained control of temperature regulation software and forced freezers to heat up to 50°C (120°F) overnight, far exceeding normal defrost cycles. The attack caused significant food spoilage, supply chain disruption, and financial losses for multiple retail chains while exposing the widespread security risks of legacy IoT infrastructure in critical operations.
This incident highlights the growing threat landscape around unsecured IoT devices as attackers increasingly target operational technology and smart infrastructure. With millions of legacy connected devices deployed across retail, healthcare, and industrial sectors lacking update capabilities, organizations face mounting pressure to address IoT security gaps before they become entry points for disruptive cyberattacks.
High impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
French Supermarket Cyberattack Exposes Critical IoT/OT Security Gaps
On October 11, 2026, attackers remotely compromised hundreds of French supermarkets by hijacking Danfoss refrigeration controllers, heating fridges and freezers to temperatures as high as 50°C. The attack affected major chains including Intermarché, Carrefour, and Coopérative U, forcing stores to discard millions of euros worth of food products. Attackers exploited vulnerabilities in older, unpatched Danfoss AK-SM and AK-SC controller models that were directly exposed to the internet without proper network segmentation or access controls. This unprecedented IoT/OT attack demonstrates the critical vulnerability of industrial control systems when proper cybersecurity measures are absent, highlighting the urgent need for better segmentation and lifecycle management of operational technology devices in retail infrastructure.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
