Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System

Introduction

Unit 42 has been actively monitoring for new developments related to the cyberattacks targeting refrigeration systems in Europe since at least October 2026. The unidentified threat actors gained unauthorized access to refrigeration controllers and set them to defrost mode, resulting in hundreds of supermarkets across the region having to throw away spoiled food. The time of year when this activity has occurred is particularly concerning since retailers need to maintain adequate inventory levels as shoppers ramp up spending during holiday periods.

Here we provide a high-level overview of the attacks based on public reporting and explore insights on device exposure by country, based on our findings using Cortex Xpanse. It also explores how Palo Alto Networks customers can leverage existing products and Unit 42 services to reduce their attack surface to mitigate similar threat activity in the future.

Background

The first wave of these attacks occurred overnight between Oct. 11–12, 2026, primarily targeting approximately 700 supermarkets in France. Since that time, another wave occurred overnight between Nov. 1–2, 2026, expanding across at least 10 additional European countries and impacting over 100–115 retail locations.

In addition to the aforementioned activity, French authorities recently disclosed that refrigeration systems used by medical facilities were impacted by the attacks. At this time, there’s no evidence to suggest blood products were spoiled as a result.

According to multiple sources, the threat actors behind the supermarket activities raised the temperature of the targeted refrigeration units as high as 50°C (122°F). In some cases, the activity resulted in fires. The initial access vector currently remains unconfirmed. However, there is widespread speculation that impacted devices were potentially running vulnerable versions of software and/or used default credentials provided by the manufacturers that attackers easily identified.

Unit 42 Insights

From Nov. 5–6, 2026, we identified the presence of over 5,000 devices exposed to the internet that were manufactured by companies listed in the CERT-FR advisory last month. These statistics do not necessarily mean that the devices are running vulnerable versions of software that could’ve been exploited. Figure 1 below illustrates these findings based on device count by the top 10 countries.

Given the impact of this malicious activity primarily affected devices in France, we decided to explore the trend of internet-exposed devices since October 1, 2026. Figure 2 below illustrates these findings where we identified a significant decline over three distinct time periods:

• October 1-15, 2026: 1,853
• October 16-31, 2026: 558
• November 1-6, 2026: 316

Censys has also reported extensively on the trends in device exposures in Europe as well.

Conclusion

On Nov. 3, 2026, the pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility for the attacks via Telegram posts, although their allegations remain unverified at this time. The Cybersecurity and Infrastructure Security Agency (CISA) also released an advisory on Nov. 5, 2026 warning of potential exploitation via authentication bypass, arbitrary code injection, and weak configurations.

Palo Alto Networks customers can leverage several products and Unit 42 services to identify and defend against potential exploitation and unauthorized access to exposed devices.

Cortex Xpanse can identify exposed devices on the public internet and escalate these findings to defenders.

Device Security is designed to provide continuous discovery, risk assessment, and protocol-level visibility across OT and IoT infrastructure, identifying weak configurations, default credentials, exposed administrative interfaces and anomalous control-plane traffic. Complementing this visibility, Frontier Virtual Patching with Advanced Threat Prevention inspects network traffic inline to block exploit attempts, command-and-control communication, and arbitrary code injection in real time. Together, these capabilities allow organizations to enforce adaptive access controls around vulnerable controllers and virtually shield unpatched firmware from unauthorized modification without disrupting critical physical operations.

Unit 42 Continuous Frontier AI Defense is an offensive security service designed to assist organizations with continuously discovering hidden and unknown exposures in dynamic environments, validate real-world exploitability across attack paths through agentic testing and expert analysis, and provide prioritized remediation and virtual patching guidance to accelerate risk mitigation.

Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.

The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.

Additional Resources

• French blood banks hacked in latest cyber-attack on Europe – The Guardian
• Hackers Crank the Heat on Europe’s Supermarket Freezers to Above 120 Degrees – WSJ
• Over 100 European Stores Hit as Supermarket Fridge Attacks Return – SecurityWeek
• Hackers disrupt refrigeration systems at European supermarkets – BleepingComputer
• The French Supermarket Attack Is Another Wake-Up Call for Every Critical Industry – Palo Alto Networks