European Refrigeration Attacks Expose OT Security Gaps
Unit 42’s analysis of attacks on European refrigeration systems highlights exposed controllers, uncertain access paths, and practical OT defenses.
Cyberattacks against refrigeration systems in Europe have demonstrated how a relatively narrow compromise of operational technology can produce immediate consequences in the physical world. According to Palo Alto Networks’ Unit 42, unidentified threat actors gained unauthorized access to refrigeration controllers and changed their operating state, including placing systems into defrost mode. The reported result was widespread food spoilage at supermarkets and, in some cases, fires.
Unit 42’s account is based on public reporting, its monitoring of the activity, and internet-exposure data collected with Cortex Xpanse. The research does not establish how the attackers first entered the affected environments, whether the same access method was used in every incident, or how they moved after gaining access. Those uncertainties are important: the operational impact is documented in the source material, but several technical details of the campaign remain unconfirmed.
What happened to the refrigeration environments
Unit 42 reports two principal waves of activity. The first occurred overnight between Oct. 11 and 12, 2026, and primarily affected approximately 700 supermarkets in France. A second wave took place overnight between Nov. 1 and 2, 2026, extending into at least 10 other European countries and affecting more than 100 to 115 retail locations, according to the research summary.
The attacks targeted refrigeration controllers rather than merely disrupting corporate IT systems. Multiple public reports cited by Unit 42 said that attackers raised the temperature of refrigeration units as high as 50°C (122°F). Unit 42 also reported that some incidents resulted in fires. The immediate business impact included the disposal of spoiled food, creating a particularly serious problem during a period when retailers were increasing inventory for holiday demand.
French authorities additionally disclosed that refrigeration systems used by medical facilities were affected. Unit 42 said there was no evidence at the time of its report that blood products had been spoiled. That detail should not be interpreted as proof that medical operations were unaffected; it means only that the specific consequence had not been established in the available reporting.
The attack sequence that is supported by the evidence
The confirmed high-level sequence is straightforward:
- Threat actors obtained unauthorized access to refrigeration-control environments.
- They altered the configuration or operating state of refrigeration controllers.
- Systems were placed into defrost mode or otherwise driven to elevated temperatures.
- Retailers experienced spoiled inventory, while some locations reportedly suffered fires.
This sequence shows why industrial and building-management systems require security controls that account for physical safety and process continuity. A controller does not need to run ransomware or exfiltrate data to create material damage. An unauthorized change to a temperature setpoint or operating mode can be enough.
However, the source does not confirm the attackers’ full path through any affected network. It does not identify a specific lateral-movement method, a particular remote-access product, or a confirmed command-and-control mechanism. Defenders should therefore avoid treating a single presumed intrusion path as established fact.
Initial access remains unconfirmed
The initial access vector is the central unresolved question. Unit 42 notes widespread speculation that affected devices may have been running vulnerable software versions or may have retained manufacturer-provided default credentials. The research presents those possibilities as speculation, not as confirmed findings from incident investigations.
The source also summarizes a Nov. 5, 2026 advisory from the Cybersecurity and Infrastructure Security Agency warning about potential exploitation involving authentication bypass, arbitrary code injection, and weak configurations. The advisory’s themes reinforce the importance of securing exposed administrative interfaces and controllers, but the supplied research does not link those potential mechanisms conclusively to every incident described in the article.
For organizations investigating similar events, this distinction matters. A controller exposed to the internet is a meaningful risk indicator, but exposure alone does not prove that the device was compromised or that it was running exploitable software. Conversely, the absence of a known vulnerability does not make an internet-facing control interface safe if authentication, authorization, and network boundaries are weak.
Internet exposure was widespread, then declined
Between Nov. 5 and 6, 2026, Unit 42 identified more than 5,000 internet-exposed devices manufactured by companies listed in a recent CERT-FR advisory. The organization explicitly cautioned that this number does not demonstrate that those devices were running vulnerable software or that they were exploited.
Unit 42 also examined exposure trends in France from Oct. 1 onward. Its reported counts declined across three periods:
- Oct. 1–15, 2026: 1,853 exposed devices
- Oct. 16–31, 2026: 558 exposed devices
- Nov. 1–6, 2026: 316 exposed devices
The decline may indicate that organizations or service providers removed devices from direct internet exposure after the activity became known, but the supplied research does not establish why the numbers changed or whether the remaining devices were secure. It also notes that Censys reported separately on European exposure trends.
Attribution claims are not verified
On Nov. 3, 2026, the pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility in Telegram posts, according to Unit 42. The organization states that those allegations remain unverified. They should therefore be treated as claims rather than attribution.
No evidence in the supplied research establishes the groups’ role in the attacks, identifies the individuals behind the activity, or connects the campaign to a specific government. The responsible analytical posture is to separate the observed operational effects from the unconfirmed identity claims.
What defenders should monitor
Organizations operating refrigeration, building-management, or related OT systems should monitor for changes that are unusual for both the device and the physical process. Useful sources include controller audit logs, engineering-station records, remote-access logs, firewall events, identity-provider logs, and configuration-management histories.
Priority review areas include:
- Unexpected changes to temperature setpoints, defrost schedules, operating modes, or alarm thresholds.
- Administrative access to controllers from unfamiliar networks, countries, hosts, or accounts.
- New internet exposure or changes to firewall and port-forwarding rules.
- Use of shared, default, dormant, or otherwise inappropriate credentials.
- Controller configuration changes that do not correspond to an approved maintenance window.
- Repeated authentication failures followed by successful administrative access.
- Control-plane traffic between systems that do not normally communicate.
- Operational anomalies, including simultaneous temperature increases across multiple sites.
These signals should be correlated with physical-process data. A security alert becomes more urgent when it coincides with rising temperatures, unexpected defrost activity, refrigeration alarms, or a loss of normal controller supervision. Monitoring should also include the remote-management paths used by refrigeration vendors and facilities teams, while recognizing that the research does not identify a specific vendor or access product as responsible.
What organizations should do now
First, build and maintain an accurate inventory of refrigeration controllers, gateways, engineering workstations, remote-access systems, and supporting building-management components. Internet-facing assets should be identified continuously rather than through occasional manual surveys. Owners should know which devices are reachable, which accounts administer them, and which business or safety processes depend on them.
Second, remove direct public exposure wherever the operational design permits. Administrative interfaces should be placed behind tightly controlled access paths, with strong authentication and restrictions based on source network, user role, and maintenance windows. Default credentials should be replaced, unused accounts disabled, and privileged access reviewed regularly.
Third, segment OT and building-management networks from ordinary corporate and guest environments. Segmentation should limit unnecessary east-west communication and restrict the systems that can issue control commands. Firewall policies should be based on required business functions, not broad convenience access. Changes to network routes, remote-access rules, and controller permissions should be logged and subject to approval.
Fourth, establish a safe recovery process. Organizations should preserve known-good controller configurations, document manual operating procedures, and test how refrigeration can be returned to a safe state if digital control is unavailable or appears manipulated. Recovery planning should include facilities personnel, refrigeration specialists, IT, security, safety teams, and relevant vendors.
Finally, investigate unexplained setpoint or mode changes as potential security incidents rather than treating them solely as equipment faults. Preserve logs and configuration snapshots before resetting systems when doing so will not create a safety risk. If compromise is suspected, coordinate containment with OT specialists so that defensive actions do not interrupt critical physical operations.
Conclusion
The incidents analyzed by Unit 42 show that refrigeration control systems can become a direct route to operational disruption. The confirmed findings include unauthorized controller access, manipulated refrigeration behavior, spoiled supermarket inventory, and reported fires at some locations. The entry method, movement within target networks, and command-and-control details remain unresolved, while claimed responsibility by NoName057(16) and Z-Pentest has not been verified.
For retailers, medical facilities, service providers, and other operators, the practical lesson is clear: discover exposed controllers, eliminate unnecessary public access, strengthen identity controls, segment operational networks, monitor configuration changes, and prepare a recovery process that accounts for physical consequences.