On November 3, 2026, pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility for a series of cyberattacks targeting refrigeration systems across Europe, as reported by Unit 42. These attacks, which began on October 11, 2026, have resulted in significant operational disruptions, including the spoilage of food in hundreds of supermarkets and potential risks to medical facilities.
Details of the Attacks
The initial wave of attacks primarily affected around 700 supermarkets in France, with subsequent incidents reported in at least ten additional European countries, impacting over 100 retail locations. The attackers reportedly manipulated refrigeration controllers, raising temperatures to as high as 50°C (122°F), which led to food spoilage and, in some cases, fires. While the exact method of initial access remains unconfirmed, speculation suggests that vulnerable software versions or default credentials may have been exploited.
Unit 42’s analysis revealed that over 5,000 devices manufactured by companies listed in a CERT-FR advisory were exposed to the internet as of November 5-6, 2026. This exposure raises concerns about the security of these devices, particularly given the timing of the attacks during a peak shopping season.
Impact and Response
In addition to the retail sector, French authorities disclosed that medical facilities’ refrigeration systems were also affected, although there is currently no evidence that blood products were compromised. The Cybersecurity and Infrastructure Security Agency (CISA) issued a warning on November 5, 2026, highlighting potential vulnerabilities such as authentication bypass and weak configurations that could be exploited in similar attacks.
As the situation develops, organizations are encouraged to assess their exposure to similar threats. Palo Alto Networks offers several solutions, including Cortex Xpanse, which helps identify exposed devices, and Device Security, which provides continuous risk assessment and visibility across operational technology (OT) and Internet of Things (IoT) infrastructures.
Looking Ahead
While the claims of responsibility by NoName057(16) and Z-Pentest remain unverified, the implications of these attacks underscore the need for heightened vigilance in securing critical infrastructure. Organizations are advised to implement robust security measures to protect against unauthorized access and potential exploitation of vulnerable systems.
For further insights into the ongoing situation and to explore defensive strategies, refer to the detailed analysis provided by Palo Alto Networks in their report on the attacks on Europe’s refrigeration systems here.
