Executive Summary
A series of cyberattacks against commercial refrigeration infrastructure has exposed a significant weakness in the operational technologies and network implementations supporting Europe's food supply and other temperature-sensitive industrial systems. Beginning with hundreds of affected supermarkets in France during October 2026, the incidents expanded across numerous European countries in early November, damaging food inventories, interrupting business operations, and prompting a coordinated response from European cybersecurity authorities.
The attacks involve unauthorized manipulation of the control and management systems responsible for refrigeration temperatures. Specifically, the attackers reportedly accessed refrigeration management interfaces and changed the operating parameters controlling defrost cycles and temperature settings causing losses of product and financial losses.
The campaign's initial wave occurred October 11th–12th in France. A second wave on November 1st–2nd affected retailers across Belgium, Luxembourg, Sweden, the Netherlands, Ireland, Estonia, and Portugal. Subsequent reporting has added Italy, Finland, Germany, and Romania, with attempted attacks against British meat-processing facilities as well.
French authorities also confirmed an unauthorized manipulation of cold-storage equipment associated with three facilities operated by the national blood service. Independent monitoring prevented the destruction of stored medical products, but the incident expanded concerns beyond ordinary commercial refrigeration attacks to other kinds of infrastructure as well.
On November 4, the European Commission, ENISA, Europol's European Cybercrime Centre, EU-CyCLONe, and the EU CSIRT Network issued a joint statement addressing the incidents. The statement recognized the scale and cross-border nature of the activity and called for immediate protective measures. The official European response establishes the incidents as a significant cybersecurity concern affecting multiple member states.
On November 9, the French government formally attributed the attack on French supermarkets to Shahid Kaveh, an offensive cyber unit operating within the Electronic and Cyber Centre of Iran's Islamic Revolutionary Guard Corps (IRGC). However, two Russian-aligned hacktivist organizations, NoName057(16) and Z-Pentest Alliance, reportedly published a video on November 4 claiming responsibility for the supermarket attacks. The groups identified Danfoss and Dixell equipment as the attack vector and asserted that they manipulated existing controller functions without malware.
Their claims are consistent with the observed operating methods and their histories of attacking exposed industrial control systems. However, the details disclosed in the video were already available through public reporting, and no independent forensic evidence has authenticated their responsibility. Romania's national cybersecurity director subsequently offered a competing assessment, describing the incidents as technically unsophisticated and stating that it did not suspect a state actor. The current intelligence picture therefore supports a distinction between strategic significance and operational attribution. The refrigeration attacks represent deliberate interference with civilian industrial processes, but their relationship to Russian state-directed hybrid warfare remains a plausible but unproven hypothesis.
On a technical level however, the assessment is the following; the affected systems were online, available to the internet, and in default states of installation. Default passwords and configurations of these systems allowed the adversaries to control and manipulate management of the refrigeration systems to cause damage to the products being refrigerated.
As such, these attacks are considered a “Trivial” attack methodology and could be undertaken by any individual or group of individuals who discovered them and decided to interfere. Given that the various claims of success by Russian aligned actors and France’s formal attribution to the Iranian state-backed Shahid Kaveh both lack independent verification of evidence, it is hard to determine the who and the why behind them. The how, however, is clear, default installations and lack of security management are the direct culprit.
Campaign Development and Operational Chronology
The cyberattacks against Europe's commercial refrigeration infrastructure began during the night of October 11–12th, 2026, when approximately 700 supermarkets across France experienced unauthorized manipulation of their refrigeration systems.
At an Intermarché location in Gradignan, a defrost cycle was reportedly extended to eight hours, driving temperatures to approximately 50°C. Three weeks later during the night of November 1st–2nd, another wave of attacks spread across Europe affecting supermarkets and food retailers in;
- Belgium
- Luxembourg
- Sweden
- Ireland
- The Netherlands
- Estonia
- Portugal
By November 3 additional incidents had been disclosed in Romania, Germany, Finland, and Italy, while British authorities confirmed attempted intrusions against meat-processing businesses, showing the focus thus far, as systems within the EU and UK.
Technical Mechanisms of Attacks
Commercial refrigeration controllers, like many other OT (Operational Technology) systems, commonly provide centralized interfaces for operating and maintaining equipment distributed throughout an organization. These refrigeration interfaces allow technicians to monitor temperatures, adjust defrost schedules, and configure alarms to perform maintenance remotely.
Systems such as the Danfoss AK-SM family and Copeland/Dixell XWEB platforms are deployed in environments where availability and reliable operation are essential. Their connectivity provides operational efficiency but it also creates potential security exposure, especially when they are not configured securely. If an attacker gains administrative access, they can potentially change operating parameters without needing to modify the underlying firmware or install additional software.
The observed attack pattern can be summarized as:
The most important distinction is that the malicious action may consist entirely of legitimate controller commands and access. The controller performs the requested action, but the request originates from an unauthorized operator. This creates a detection problem because normal maintenance activities and malicious process manipulation may generate similar administrative events.
Detecting these kinds of attacks depends on authorization contexts, account identities, configuration history, and the timing of changes. The evidence currently suggests that in this case, the attacks are against the management layer rather than deployment of any bespoke industrial malware. However, the exact initial-access mechanism remains unresolved for the November wave. No substantive evidence has been presented by the companies nor the investigating bodies involved as yet.
There are, however, some vulnerabilities for these systems that are already known from CVE’s that have been published. Claroty Team82 documented three significant vulnerabilities affecting Danfoss AK-SM 800A refrigeration management systems.
These included authentication bypass, authenticated command injection, and manipulation of web-server configuration.
Earlier vulnerabilities in the same product family include:
The older Danfoss AK-SM 800 and AK-SC 355 models are end-of-life products and require particular attention because normal security patching may no longer be available. These vulnerabilities are one of the security risks associated with exposed management interfaces on top of potential default configuration issues that can lead to compromise.
Internet Exposed Refrigeration Controllers
Independent research by Flare and Censys identified a substantial population of publicly accessible refrigeration management systems. Flare's baseline research identified at least 2,667 distinct public IP addresses associated with exposed refrigeration management interfaces. In a sample of 547 confirmed addresses, 356 exposed additional services as well, including remote desktop systems, camera and video services, and VPN infrastructure.
Refrigeration controllers are frequently part of more complex remote access environments, hence the co-location of services. In these instances, a single public IP may represent access to multiple internal services operating behind a router, firewall, or network address translation gateway. This creates multiple possibilities for unauthorized access and potentially larger attack surfaces for more companies' devices online.
Thus, an attacker may connect directly to the controller's management interface, compromise a separate administrative service or obtain access through a contractor-operated VPN accessing multiple systems. However, the presence of a VPN on an exposed address does not establish that it was compromised or used during an attack. Independently, the security company Censys scanned the internet and found a large number of the Danfoss interfaces on the internet available to access.
A significant percentage of the exposed systems in some countries appeared to be running the supported firmware with open access to the internet, reinforcing the importance of access controls and basic security management. Patching known vulnerabilities does not protect a controller if an unauthorized person can authenticate using a weak or reused password.
Network and Forensic Indicators Thus Far
No confirmed attacker-controlled IP addresses, domains, VPN exit nodes, or malware hashes have been publicly established for the campaign. One previously reported address, 188.208.141[.]210, was associated with authentication attempts against a Danfoss honeypot during October. However, this is a reconnaissance lead and has not been forensically connected to any confirmed European victim and therefore should not be classified as a verified campaign IOC.
Investigation of IP address space 188.208.141[.]210 identified reconnaissance and attempted authentication against a Danfoss AK-SM refrigeration controller honeypot during October 25–27, 2026. The address resides within the 188.208.141.0/24 netblock, announced by AS132335 LeapSwitch Networks Private Limited. This is an India-based hosting provider operating geographically distributed infrastructure.
Researchers at Previdian observed the address initially accessing a simulated Danfoss AK-SM 800A management interface in Finland on October 25th with an HTTP Referer suggesting possible discovery through a FOFA (internet asset search platform) report . The source returned on October 27 and conducted additional reconnaissance, requesting SVB5.ver and metadata.json to identify controller information before using Python-based requests to attempt authentication through the /xml.cgi endpoint.
Three login attempts using documented factory-default credentials were all unsuccessful. The activity demonstrates deliberate controller fingerprinting followed by attempted unauthorized access rather than exploitation of the documented Danfoss authentication-bypass vulnerability, CVE-2025-41450.
Although other addresses within the LeapSwitch netblock have appeared in unrelated abuse reporting, no evidence establishes coordinated malicious activity across the netspace. The source address remains a credible reconnaissance indicator associated with Danfoss management infrastructure, but no forensic evidence currently links it to the European refrigeration sabotage campaign.
November 4 claims by NoName057(16) and Z-Pentest Alliance
Russian-aligned hacktivist organizations NoName057(16) and Z-Pentest Alliance made a claim that they had been the actors behind the attacks. This emerged through public hacktivist communications by these groups on Telegram , and on November 4, Italian broadcaster Rai TG1 released a video claiming responsibility for the European supermarket attacks by the groups.
The groups described interference with Danfoss and Dixell management systems and asserted that the operation did not require malware. They also threatened further attacks against water, energy, industrial, and food-storage infrastructure. The claim is aligned with previous Z-Pentest posts advertising intrusions involving exposed industrial control systems.
(Machine Translation: We stand with the people: Punishing European politicians for their crimes, Wrecking Refrigerators titles)
Additionally, on their darknet site, NoName057(16) also made claims about hacking other infrastructure in the EU, including France during the recent protests that have been taking place in October and November. However, none of these videos actually show hands on keyboard access or video proof that they had access to anything. The groups' statements did not demonstrate possession of nonpublic forensic details concerning the European victims. Manufacturer names, defrost manipulation, and publicly reported consequences were already widely available. Additionally, both NoName057(16) and Z-Pentest have a history of claiming attacks on OT (Operational Technology) systems in support of Russia.
Given the existing evidence, these claims are best assessed as propaganda unless the groups share proof of their role in the attacks.
An Alleged Danfoss Credential Database Leak
Associated reporting by SVT described an alleged database containing more than 2,500 records involving Danfoss employees or customers that NoName057(16) claimed to be in possession of on their telegram channel. The records reportedly included usernames and passwords. If authentic and operationally relevant, such a collection could help explain access to multiple installations through common credentials or maintenance accounts.
The dataset has not been independently authenticated, though one source claims to have had access to the data; its age, provenance, validity, and relationship to the affected installations remain unknown. Seeing as there is also no verified evidence that the records were actually used to access refrigeration controllers, the database should remain a high-priority investigative lead rather than a confirmed compromise artifact.
Threat Actor Assessment: NoName057(16), Z-Pentest & CARR
NoName057(16) emerged in 2022 as a pro-Russian hacktivist organization primarily associated with distributed denial-of-service attacks against governments and other organizations in countries supporting Ukraine. Its operations have combined service disruption with public propaganda intended to promote the Kremlin’s geopolitical narratives.
Z-Pentest developed a more specialized focus on exposed industrial control systems. The group has claimed access to remotely managed industrial equipment, including human-machine interfaces and systems used in civilian infrastructure. Its historical activity makes it a technically plausible suspect in the refrigeration incidents.
These are not the only Russian aligned actors with a history of targeting civilian infrastructure and refrigeration systems. The attribution of CyberArmyofRussia_Reborn, or CARR, provides a particularly important historical comparison. U.S. authorities previously attributed a 2024 refrigeration-related attack against a Los Angeles meat-processing facility to CARR. That incident reportedly produced food spoilage and an ammonia leak.
A December 2025 multinational advisory documented relationships among NoName057(16), Z-Pentest, and CARR. These relationships establish an overlapping operational environment associated with pro-Russian disruptive activity. They do not prove that Russian intelligence directed the current campaign, nor do they establish that all three organizations operated as a single group during the European incidents.
Attribution Judgment For Claims By NoName057(16)
NoName057(16) and Z-Pentest are credible investigative leads because of their reported claims, targeting histories, and demonstrated interest in exposed industrial equipment. However, the available evidence does not justify assigning them responsibility with moderate or high confidence. Direct Russian state sponsorship of these attacks remains even less certain but would fit the pattern of attacks on the EU that have been taking place in recent months. In line with this, the European Commission and ENISA's November 4 statement regarding the attacks reinforces the need for cross-border information sharing and coordinated mitigation.
French Government Attribution: IRGC Shahid Kaveh and the October 2026 Refrigeration Attacks
On November 9, 2026, France formally attributed the October 11–12 cyberattacks against its commercial refrigeration infrastructure to Shahid Kaveh, an offensive cyber unit operating within the Electronic and Cyber Centre of Iran's Islamic Revolutionary Guard Corps (IRGC). The attribution was published in technical intelligence report CERTFR-2026-CTI-009, prepared by France's interagency Cyber Crisis Coordination Centre (C4), which brings together ANSSI, COMCYBER, the DGA, DGSE, and DGSI.
The assessment identifies the IRGC as the organization directing the operation and Shahid Kaveh as the executing unit. This represents a significant development in an investigation previously characterized by competing hacktivist responsibility claims, uncertainty concerning initial access, and limited publicly available forensic evidence.
French investigators additionally identified concurrent targeting of Schneider Electric equipment at small hydroelectric installations. C4 associated this activity with the refrigeration operation and reported moderate effects on the equipment. The inclusion of energy infrastructure suggests a broader industrial targeting effort extending beyond food refrigeration, although the public report does not disclose the affected facilities or the exact control functions manipulated.
Technical Evidence Supporting Attribution
C4 describes its attribution as a convergence of technical and intelligence indicators rather than reliance on a single artifact. Four findings underpin the French assessment.
- Alleged Shared operational infrastructure. Infrastructure used to conduct the refrigeration attacks was also employed during the same period for reconnaissance against Schneider Electric industrial equipment. This is the most significant technical connection disclosed because it links the refrigeration operation with separate industrial targeting activity associated with Shahid Kaveh.
- Established industrial reconnaissance methods. C4 reports that Shahid Kaveh has possessed scripts for scanning, and attempting to control Schneider Electric, Siemens, and Rockwell industrial equipment since at least June 2024. In April 2026, the unit conducted large-scale reconnaissance involving Modbus/TCP port 502 against Schneider Electric systems including targets in France. The French assessment identifies similar activities associated with the October campaign. Importantly, the report does not state that Modbus was the exploitation protocol used against Danfoss refrigeration controllers.This is just a reference to tactics and operational details that are akin to the recent attacks.
- FOFA-assisted target discovery. Investigators determined that operators used the FOFA internet asset discovery platform during the refrigeration operation. FOFA is commonly used to identify publicly accessible network services and industrial management interfaces. Its presence is consistent with reconnaissance against exposed refrigeration controllers, although use of the platform alone is not sufficient for attribution because it is available to legitimate researchers and multiple threat actors.
- Iranian-language and communications indicators. Investigators recovered traces of Farsi within the attack infrastructure used. C4 also identified coverage of the refrigeration attack by CyberbanNews on October 13, describing the outlet as associated with Shahid Kaveh. These observations provide additional circumstantial clues, but do not directly tie these actors to the attacks in question.
Taken together, these indicators support France's attribution to Shahid Kaveh. However, the public report does not release the forensic artifacts required for independent technical reproduction. The attribution should therefore be identified as a formal French interagency intelligence finding rather than an independently reproducible open-source attribution.
Shahid Kaveh and Its Hacktivist Identities
C4 places Shahid Kaveh within the IRGC's Electronic and Cyber Centre and identifies Mahdi Lashgarian and Reza Salarvand as commanders of the unit. Its organizational annex separately identifies Hamid Reza Lashgarian as the head of the IRGC Electronic and Cyber Centre.
The report attributes Shahid Kaveh to several public-facing hacktivist identities, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul, and Cyber Isnaad Front, as well as the communications outlet CyberbanNews. According to C4, these identities are used to publicly claim selected operations conducted by the unit.
This association is significant for the refrigeration investigation because Iranian-aligned actors have previously claimed attacks against industrial controllers including Unitronics equipment in November 2023. C4 also reports a Shahid Kaveh claim concerning a broader sabotage campaign against Israeli and American interests in March through April 2026, which reportedly involved Israeli refrigeration equipment.
The French attribution also complicates the interpretation of competing hacktivist claims. NoName057(16) and Z-Pentest publicized alleged involvement in the European refrigeration disruptions during November, but C4's assessment attributes the October French operation to an Iranian state unit. Those later claims cannot be treated as proof that the Russian-aligned groups executed the October intrusion.
Iranian Media Activity and Potential Operational Signaling
According to Cyberban's International Affairs Working Group, French officials have accused Iran's Islamic Revolutionary Guard Corps (IRGC) of carrying out a cyberattack last month that disrupted refrigeration systems at approximately 700 food retail stores in France.
Subsequent open-source collections identified Iranian-language Telegram reporting about the attacks, including material distributed through CyberbanNews. A recovered Persian-language item described manipulation of French refrigeration systems, elevated temperatures, and disruption to food distribution. Separate Iranian-language commentary portrayed the incident as evidence of European infrastructure vulnerability and warned of potential attacks against European infrastructure in the event of direct or indirect participation in military action against Iran.
Consequently, the communications support the documented existence of Iranian-aligned interest and narrative amplification, but do not independently establish the publisher's operational role.
Defensive Recommendations
Final Intelligence Assessment
The October and November 2026 refrigeration attacks represent a significant example of cyber-enabled interference with civilian operational technology. The incidents demonstrate how remotely accessible industrial management systems can be manipulated to cause substantial physical and economic consequences without the deployment of conventional malware or the need for exploits to access these types of systems.
The campaign has affected hundreds of French supermarkets, expanded across numerous European countries, and prompted a coordinated response from the European Union's principal cybersecurity organizations. Additional incidents involving British food-processing firms and French medical cold-storage infrastructure illustrate the broader vulnerability of temperature-dependent civilian systems.
The available technical evidence increasingly supports weaknesses in remote administration and authentication as major contributors to the attacks. Known Danfoss vulnerabilities remain relevant to exposure management, but their exploitation has not been established as the cause of the incidents.
No verified attacker-controlled domain, VPN endpoint, proxy network, or common malicious source IP has been publicly identified. NoName057(16) and Z-Pentest have reportedly claimed responsibility, but the claim has not been independently substantiated and conflicts with C4’s attribution of the October France wave to Shahid Kaveh. While Russia's documented campaign of espionage, sabotage, and influence activity against Europe provides a credible strategic context for investigating Russian-aligned involvement, it does not establish Russian state direction or operational control.
France’s attribution, made without releasing forensic artifacts for independent verification, also muddies the waters concerning what nation state actors, if any, were responsible for the attacks and what the goals might have been. Without independently verified evidence for either Russia’s or Iran’s involvement in these attacks, these events may well just be non-state actors sowing chaos for fun.
The real lesson to be learned however, is that at present, the leading contention is that these systems were online and insecure by proxy of not being secured. Default configurations, passwords, and lack of alarms as well as logging places these systems at greater security risk and as we have seen, create outsize financial and political effects when they are successfully attacked.
The principal conclusion remains that the European refrigeration incidents demonstrate a repeatable capability for cyber-physical disruption against civilian infrastructure, while the precise perpetrators, coordination mechanisms, and strategic objectives remain unresolved.
