A second round of freezer cyber attacks have occured in Europe. No one has publicly claimed responsibility, and authorities have not attributed the attacks to any specific individual, group, or country. Recent supermarket freezer/refrigeration disruptions (primarily overnight into Monday, 2-3 November 2026) involved cyber-attacks that remotely switched internet-connected refrigeration controllers into continuous defrost mode. This caused temperatures in freezers and fridges to rise sharply (reports of up to ~50°C / 122°F in multiple places), spoiling large quantities of chilled and frozen food that had to be discarded.
Key details / Scope: Dozens to over 100 stores affected across at least 7–10 European countries, including Belgium (notably many Delhaize and some Carrefour/Spar locations), Luxembourg, Sweden (ICA, Coop, and others), Ireland (SuperValu), the Netherlands, Estonia, Finland, and reports involving others such as Italy or Portugal in some coverage. This followed a larger wave in France about three weeks earlier (around 11-12 October 2026) that hit hundreds of stores.
Method: Attackers targeted remote-management interfaces on commercial refrigeration systems (equipment from manufacturers such as Danfoss and others has been referenced in related reporting). Systems were forced into defrost, sometimes with alarms reportedly disabled or delayed. No ransomware demands or data theft have been widely reported with the apparent goal was disruption and food waste.
Response: Stores discarded spoiled stock (individual losses in some cases reached tens or hundreds of thousands of euros). Technicians disconnected affected units; national cybersecurity agencies and prosecutors (e.g., in Belgium) opened investigations. EU officials, including Agriculture and Food Commissioner Christophe Hansen, described the incidents as a deliberate attempt to disrupt the food supply chain and undermine consumer confidence, while stating that overall food security was not currently at risk.
Attribution Assessment — 3 November 2026: The sources reviewed do not establish who caused the latest European refrigeration shutdowns. No public claim of responsibility has been corroborated. Similarities with the October incidents in France provide a possible investigative connection, but do not establish that the same attackers conducted both waves. Affected equipment suppliers and maintenance contractors should not be described as perpetrators merely because their systems were involved.[1]
Possible connection to previously observed refrigeration attacks: Forescout’s Vedere Labs identified more than 20 claimed attacks against refrigeration systems since January 2026 and named Z-Pentest Alliance and NoName057(16) as the most active groups in that tracked activity. This makes earlier refrigeration-targeting activity relevant background for investigators, not evidence that either group caused the November supermarket incidents. No verified connection to either group is established by the sources reviewed here.[2]
Technical connection and confidence limits: Reporting on the November incidents describes remote changes to refrigeration settings, including defrost mode, and involvement of Danfoss controls, resembling the earlier French incidents. A shared equipment family or method can reflect a common exposure rather than a common perpetrator. Attribution would require corroborating evidence such as access logs, attacker infrastructure, or independently validated claims; the public material reviewed does not provide that evidence. State-linked sabotage and opportunistic disruption therefore remain unconfirmed hypotheses, not findings.[3]
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] The Hacker News, Swati Khandelwal, “New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food,” November 3, 2026. Reports no claim by Monday night and no established link to the French attack. https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html (accessed November 3, 2026).
[2] Forescout Research – Vedere Labs, “Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk.” Reports more than 20 claimed refrigeration attacks since January 2026 and identifies Z-Pentest Alliance and NoName057(16) in that prior activity; this is not attribution of the November supermarket incidents. https://www.forescout.com/blog/cold-chain-open-control-exposed-refrigeration-systems-reveal-global-risk/ (accessed November 3, 2026).
[3] The Hacker News, “New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food,” November 3, 2026, https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html; Industrial Cyber, “Forescout warns internet-exposed refrigeration controls could enable attacks on food supply chains and hospitals,” October 23, 2026, https://industrialcyber.co/industrial-cyber-attacks/forescout-warns-internet-exposed-refrigeration-controls-could-enable-attacks-on-food-supply-chains-and-hospitals/ . The latter notes that responsible actors and attacker infrastructure in the French incidents remain unconfirmed (accessed November 3, 2026).
Comments