Turning Up the Heat: How Pro-Russian Hacktivists Took Down Europe's Cold Chain in 2026
Turning Up the Heat: How Pro-Russian Hacktivists Took Down Europe's Cold Chain in 2026
Beginning overnight on October 11–12, 2026, unidentified threat actors—later claimed by pro-Russian hacktivist groups NoName057(16) and Z-Pentest—compromised internet-exposed industrial refrigeration controllers across Europe, forcing units into defrost mode and raising temperatures as high as 50°C (122°F). Approximately 700 French supermarkets were impacted in the first wave, with a second wave on November 1–2 expanding to over 100 locations across at least 10 additional countries. Initial access likely exploited vulnerable firmware versions and default manufacturer credentials. Physical consequences included mass food spoilage, fires, and disruption to medical facility refrigeration systems. Unit 42 identified more than 5,000 affected-manufacturer devices still exposed to the internet as of November 5–6, 2026.
This incident underscores the escalating weaponization of ICS/OT infrastructure by hacktivist actors aligned with geopolitical agendas. As operational technology converges with internet-connected environments, attacks on cold-chain and critical-supply infrastructure are becoming a preferred vector for state-adjacent groups seeking measurable, real-world disruption without formal military attribution.
Critical impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Hackers Are Targeting Your Refrigerators: FBI & CISA Sound the Alarm on ICS Cold-Chain Attacks
In November 2026, the FBI, CISA, HHS, USDA, and DOT issued a joint advisory warning that threat actors are actively exploiting unpatched or internet-exposed electronic temperature controllers and commercial refrigeration management systems across healthcare, food production, chemical, and transportation sectors. Attackers leverage authentication bypass vulnerabilities and arbitrary code injection flaws to remotely alter temperature settings, force continuous defrost cycles, and suppress operator visibility—causing food spoilage, equipment damage, fire hazards, and unsafe blood-product storage. The warning followed confirmed attacks on an estimated 250–350 French supermarkets and a French Blood Establishment facility where stored blood products were placed at risk.
This advisory reflects a broadening ICS/OT threat landscape where operationally critical but historically under-secured devices—such as refrigeration controllers—are now primary targets. The convergence of IT and OT networks, combined with internet-exposed legacy devices running default credentials, has lowered attacker barriers significantly, signaling an urgent need for OT-specific zero trust segmentation and network visibility strategies.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
One Vulnerability, 700 Stores: How Europe's Freezer Hacks Exposed the Hidden Risk of Shared OT Infrastructure
On the night of October 11, 2026, an unknown threat actor compromised refrigeration control systems—specifically Danfoss AK-SM/AK-SC controllers and Copeland/Dixell XWEB systems—used by hundreds of French supermarkets, triggering extended defrost cycles that spoiled food, damaged equipment, and reportedly started fires across roughly 700 stores. The attack exploited internet-accessible OT devices running default credentials and unpatched legacy firmware, enabling the same technique to be replicated across borders into Belgium, Estonia, Germany, Ireland, Luxembourg, the Netherlands, Poland, Portugal, Spain, and Sweden within weeks. Total damages ran into the millions of euros and a near-simultaneous attack targeted French blood-bank refrigeration units, narrowly avoiding destruction of blood plasma.
This incident underscores a maturing attacker playbook targeting shared OT infrastructure: when dozens of retailers deploy the same controller model, same remote-access pattern, and same default credentials, a single reconnaissance sweep yields hundreds of targets. CERT-FR's post-incident advisory and parallel EU grocery-sector warnings signal growing regulatory and sector-level pressure to treat food-cold-chain OT as critical infrastructure.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Cold-Chain Under Attack: How Two Waves of ICS/OT Sabotage Exposed Europe's Refrigeration Security Gap
In October and November 2026, an unknown threat actor executed two successive waves of cyberattacks against Internet-connected commercial refrigeration controllers at hundreds of European supermarkets across France, Belgium, Germany, the Netherlands, Portugal, Poland, Spain, Luxembourg, Estonia, Ireland, Sweden, and Finland. Attackers exploited unpatched firmware vulnerabilities and default credentials in controllers manufactured by Danfoss, Dixell, and Copeland—forcing systems into defrost mode at 50°C (122°F) and triggering widespread food spoilage. The first wave impacted over 700 stores; the second struck dozens more. No group has claimed responsibility, and European authorities are actively investigating.
These incidents underscore a worsening pattern of ICS/OT sabotage targeting Internet-exposed operational technology with poor security hygiene. As threat actors increasingly leverage automated scanning, credential stuffing, and known CVEs against legacy OT devices, the attack surface extends far beyond retail—threatening pharmaceutical cold storage, food distribution, and industrial temperature-control systems globally.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Hackers Turned Up the Heat: How Europe's Supermarket Fridges Became an ICS/OT Battleground
In the early hours of November 2, 2026, threat actors remotely manipulated industrial refrigeration controllers across supermarkets in Belgium, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal, and Italy. Attackers exploited internet-exposed Danfoss AK-SM and AK-SC series controllers—many running outdated firmware with default credentials and no VPN protection—switching units into defrost mode or raising setpoints to 50°C. Dozens of stores across chains including Delhaize, Carrefour, ICA, Coop, and SuperValu were forced to discard or pull chilled and frozen goods, with one Belgian butcher estimating €15,000 in losses. The attack mirrored a nearly identical campaign against hundreds of French supermarkets three weeks prior.
This second wave confirms that ICS/OT attacks on retail cold-chain infrastructure are becoming a repeatable, scalable playbook. Attackers require no sophisticated zero-day—only internet-exposed legacy controllers with default passwords. As regulators across the EU accelerate NIS2 enforcement and critical-infrastructure owners expand OT connectivity, the window for unprotected industrial devices to be weaponized for economic disruption is widening rapidly.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Cold Chain Under Attack: How Hackers Shut Down Refrigerators Across Europe's Supermarkets
In November 2026, threat actors remotely exploited vulnerabilities in industrial refrigeration controllers—specifically Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB units—to manipulate temperature settings across more than 115 supermarket locations in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Attackers activated defrost functions and raised freezer temperatures to as high as +50°C overnight, forcing emergency food disposal and the deployment of refrigerated trucks. Over a dozen retail chains were impacted, including Ahold Delhaize, Carrefour, Coop, ICA, and SuperValu. The attack vector was attributed to the same unpatched vulnerability exploited in a comparable campaign targeting French supermarkets the prior month, with refrigeration vendor Sabcobel identified as a common technology supplier across affected sites.
This incident follows a documented escalation in ICS/OT-targeted attacks against civilian critical infrastructure—specifically cold-chain and food-retail systems. As operational technology converges with internet-connected management platforms, the attack surface for remote exploitation expands dramatically, and the consequences move beyond data loss into tangible physical and economic harm.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Frozen Out: How Unpatched Fridge Firmware Burned 700 European Supermarkets
In October 2026, attackers exploited unpatched firmware vulnerabilities in commercial refrigeration controllers — specifically CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 in Danfoss AK-SM 800A, as well as 23 flaws in Dixell/Copeland XWEB Pro — to sabotage refrigeration systems across more than 700 European grocery stores in a single night. Threat actors gained remote access via third-party service providers managing legacy OT equipment, manipulated defrost cycles to disguise the attack as routine maintenance, and forced temperatures above 50°C, destroying perishable inventory and triggering minor fires. Intermarché alone reported tens of millions of euros in losses, with impacts spanning France, Spain, Portugal, Poland, Germany, and Belgium. Attackers accessed systems through unmonitored third-party OT vendor connections on internet-exposed controllers running end-of-life firmware dating to 2016.
This incident signals a sharp escalation in ICS/OT sabotage targeting civilian food infrastructure. With thousands of Danfoss systems still internet-exposed and researchers having published exploit details just weeks before the attack, the gap between vulnerability disclosure and weaponization is closing dangerously fast — raising urgent questions about third-party OT access governance across critical supply chains.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
European Grocery Chains Hit by Massive Refrigeration System Cyberattack
In October 2026, cybercriminals exploited unpatched vulnerabilities in Danfoss and XWEB refrigeration controllers across over 400 European grocery stores, converting refrigerators and freezers into heating units that reached 50°C (120°F). The attackers manipulated defrost cycles to mask the sabotage, causing complete spoilage of perishable inventory and estimated losses exceeding several million euros. The attacks leveraged CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 affecting end-of-life Danfoss AK-SM 800A platforms, along with 23 vulnerabilities in XWEB Pro systems disclosed by Claroty researchers in August 2026.
This incident highlights the growing threat to operational technology (OT) environments where legacy industrial control systems remain Internet-exposed and unpatched. As critical infrastructure increasingly relies on connected IoT devices for remote monitoring and control, attackers are shifting focus from traditional IT networks to industrial systems that can cause immediate physical and financial damage.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
French Supermarket Cyberattack Exposes Critical IoT Security Gaps in Connected Refrigeration Systems
In October 2026, cybercriminals targeted connected refrigeration systems across French supermarket chains, exploiting vulnerabilities in older Danfoss IoT units that could not receive security updates. Attackers gained control of temperature regulation software and forced freezers to heat up to 50°C (120°F) overnight, far exceeding normal defrost cycles. The attack caused significant food spoilage, supply chain disruption, and financial losses for multiple retail chains while exposing the widespread security risks of legacy IoT infrastructure in critical operations.
This incident highlights the growing threat landscape around unsecured IoT devices as attackers increasingly target operational technology and smart infrastructure. With millions of legacy connected devices deployed across retail, healthcare, and industrial sectors lacking update capabilities, organizations face mounting pressure to address IoT security gaps before they become entry points for disruptive cyberattacks.
High impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
French Supermarket Cyberattack Exposes Critical IoT/OT Security Gaps
On October 11, 2026, attackers remotely compromised hundreds of French supermarkets by hijacking Danfoss refrigeration controllers, heating fridges and freezers to temperatures as high as 50°C. The attack affected major chains including Intermarché, Carrefour, and Coopérative U, forcing stores to discard millions of euros worth of food products. Attackers exploited vulnerabilities in older, unpatched Danfoss AK-SM and AK-SC controller models that were directly exposed to the internet without proper network segmentation or access controls. This unprecedented IoT/OT attack demonstrates the critical vulnerability of industrial control systems when proper cybersecurity measures are absent, highlighting the urgent need for better segmentation and lifecycle management of operational technology devices in retail infrastructure.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Major Cyberattack Forces Ahold Delhaize to Take Systems Offline Across Global Retail Operations
In October 2026, multinational retail giant Ahold Delhaize experienced a significant cyberattack that forced the company to take critical systems offline as a precautionary measure. The incident impacted operations across multiple brands including Stop & Shop, Albert Heijn, Food Lion, and Delhaize, affecting employee access to scheduling systems and customer-facing platforms including websites, mobile apps, and online ordering services. While stores remained open for in-person shopping, the attack disrupted digital services for millions of customers across Europe and the United States, highlighting vulnerabilities in retail supply chain infrastructure.
This incident underscores the escalating threat landscape targeting critical retail infrastructure, particularly as cybercriminals increasingly focus on high-impact sectors during peak operational periods. The attack represents a growing trend of sophisticated threat actors targeting multinational corporations with complex hybrid cloud environments and extensive digital ecosystems.
Medium impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
How Cybercriminals Shut Down Refrigerators at 350 French Supermarkets
In October 2026, threat actors executed a coordinated cyberattack against French supermarket chains including Intermarché, Coopérative U, Carrefour Market, and Leclerc, affecting 250-350 stores. The attackers exploited vulnerabilities in Danfoss refrigeration controllers to remotely trigger defrosting systems, raising temperatures to 50 degrees Celsius and causing massive food spoilage and financial losses. The attack leveraged known CVEs (CVE-2025-41450 and CVE-2025-41451) in older Danfoss AK-SM 800A series controllers that were publicly accessible via the internet.
This incident represents an alarming evolution in critical infrastructure attacks, demonstrating how operational technology vulnerabilities can cause immediate physical and economic damage. With over 4,500 similar Danfoss devices exposed online globally, this attack highlights the urgent need for better OT security practices and network segmentation in critical supply chain infrastructure.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
