Unknown intruders switched European refrigeration controllers into defrost mode

Without authorization, unknown intruders accessed refrigeration controllers at European supermarkets and switched the units into defrost mode overnight Oct. 11–12, 2026, according to Unit 42’s technical breakdown of the attacks. ends here

The first wave hit overnight Oct. 11–12, 2026, and France bore the brunt, with about 700 supermarkets affected. Across Europe, hundreds of supermarkets had to discard spoiled food after the intrusions caused food spoilage by switching refrigeration controllers into defrost mode.

A follow-up wave struck overnight Nov. 1–2, 2026, reaching at least 10 additional European countries and affecting between 100 and 115 stores. Retailers were concerned about the timing because spending rises during the holidays and stores must keep adequate inventory on hand.

Temperatures on targeted refrigeration units rose as high as 50°C (122°F), Unit 42 said, and some incidents produced fires. Defrost mode is the normal cycle that melts frost buildup on cooling coils. Authorities in France said the intrusions hit refrigeration systems serving medical facilities. Officials have found no sign that blood products spoiled as a result of the attacks.

Pro-Russian hacktivist groups NoName057(16) and Z-Pentest — politically motivated hackers — said on Telegram, an encrypted messaging service, in messages dated Nov. 3, 2026, that they were behind the intrusions. Unit 42 said it has not verified the groups’ allegations, and the claims remain unverified.

Investigators have not confirmed how the intruders first got into the systems. Widespread speculation holds that affected devices might have run vulnerable software or used manufacturer-supplied default credentials. Default credentials are factory-set login details that come with a device. An advisory from CISA, dated Nov. 5, 2026, warned of possible exploitation through weak configurations, authentication bypass, and arbitrary code injection.

Unit 42 counted more than 5,000 internet-connected devices, Nov. 5–6, 2026, from vendors named in a CERT-FR advisory issued the prior month. That count does not show the devices were running exploitable vulnerable software. France’s internet-exposed device counts dropped over three periods: 1,853 during October 1-15, 2026, 558 during October 16-31, 2026, and 316 during November 1-6, 2026.

Cortex Xpanse discovers internet-exposed devices and sends its findings to defenders. Device Security continuously discovers assets, evaluates risk, and provides protocol visibility for OT and IoT systems. OT and IoT are operational technology and internet-of-things devices: computers and devices that run physical equipment and connect to networks. It flags insecure settings, factory-set login credentials, open management interfaces, and unusual control-plane traffic.

Censys has also published reporting on exposure trends for European devices. Frontier Virtual Patching with Advanced Threat Prevention inspects inline network traffic as it happens, blocking exploit attempts, command-and-control traffic used to control compromised devices, and arbitrary code injection. Unit 42 Continuous Frontier AI Defense, an offensive security service, finds exposures, tests their exploitability through agentic testing — autonomous agents probing for weaknesses — and expert analysis, and prioritizes remediation with virtual patching guidance.

Virtual patching blocks exploit attempts by inspecting traffic before it reaches devices. Unit 42 Threat Intel Services, together with its Deep and Dark Web Service, provides customized threat intelligence, analyst consultations, and focused exposure monitoring. The Unit 42 Incident Response team can help organizations during a compromise or run a proactive assessment to lower risk.