Critical Threat to Europe’s Refrigeration Systems
Unidentified threat actors have launched a series of cyberattacks against refrigeration systems across Europe, leading to significant disruption, extensive food spoilage, and even fires in affected locations. These sophisticated attacks, first observed in October 2026, demonstrate a concerning escalation in the targeting of operational technology (OT) and industrial control systems (ICS) within critical infrastructure sectors, specifically impacting the food supply chain and medical facilities. Organizations operating such systems are urged to review their security postures, as highlighted by Unit 42.
Technical Analysis of Attacks on European Refrigeration Systems
The initial wave of attacks occurred between October 11-12, 2026, primarily affecting approximately 700 supermarkets in France. A subsequent wave, between November 1-2, 2026, expanded the scope to over 10 additional European countries, impacting 100-115 retail locations. French authorities also confirmed that refrigeration systems within medical facilities were compromised, though thankfully, no blood products were reported spoiled.
Threat actors gained unauthorized access to refrigeration controllers and manipulated them, primarily by setting them into defrost mode. In severe instances, temperatures were raised as high as 50°C (122°F), directly causing spoilage of perishable goods and, in some cases, resulting in fires. This direct physical impact underscores the severe consequences of OT system compromise.
The precise initial access vector for these attacks remains unconfirmed. However, widespread speculation suggests that vulnerable software versions or the use of default credentials provided by manufacturers may have been exploited. Unit 42’s analysis, leveraging Cortex Xpanse, identified over 5,000 internet-exposed devices from manufacturers listed in a CERT-FR advisory, emphasizing the potential attack surface. While not all these devices are necessarily vulnerable, their exposure significantly increases risk. Censys has also reported on similar trends in device exposure across Europe.
On November 3, 2026, pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility for the attacks via Telegram. However, these claims currently lack verification. The Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on November 5, 2026, warning of potential exploitation avenues, including authentication bypass, arbitrary code injection, and weak configurations, which align with the observed impact on refrigeration controllers.
Mitigating OT/IoT Refrigeration System Attacks
Given the severity and widespread nature of these attacks, immediate and proactive measures are essential for organizations operating OT/IoT refrigeration systems:
- Patch Management and Updates: Prioritize the patching of all refrigeration system controllers and associated OT/IoT devices to their latest secure versions. This addresses known vulnerabilities that could be exploited.
- Strong Authentication and Credential Management: Immediately change all default credentials on operational technology devices. Implement strong, unique passwords and, where supported, multi-factor authentication (MFA) to prevent unauthorized access.
- Network Segmentation: Isolate OT/IoT networks from corporate IT networks and the public internet. Implement strict firewall rules to limit communication to only necessary services and devices. This is crucial for containing potential breaches.
- Continuous Asset Discovery and Vulnerability Assessment: Regularly scan for and identify all internet-exposed OT/IoT devices. Tools capable of providing continuous discovery, risk assessment, and protocol-level visibility across OT/IoT infrastructure are vital for understanding and reducing the attack surface.
- Anomalous Activity Monitoring: Implement monitoring solutions that can detect unusual temperature changes, unauthorized configuration modifications, or atypical network traffic patterns originating from refrigeration controllers.
- Incident Response Planning: Develop and regularly test incident response plans specifically tailored for OT/ICS environments, including procedures for physical intervention and system restoration.
- Vendor Guidance: Consult manufacturer advisories and security guidelines for specific recommendations on securing refrigeration systems. The CISA advisory also offers valuable insights into potential exploitation vectors.
Addressing these critical security gaps is paramount to preventing further disruption to essential services and protecting against the significant economic and safety impacts demonstrated by these ongoing attacks on European refrigeration systems.
Related: Cloudflare Impact Programs Surpass $100M in Donated Services, FBI and CISA Warn of Cyberattacks Targeting Refrigeration Systems