No Zero-Day Required: Europe's Second Wave of Supermarket Fridge Attacks

Overnight from Sunday 1 to Monday 2 November 2026, attackers again tampered with internet-exposed refrigeration controllers across Europe, raising temperatures in supermarket fridges and freezers and forcing retailers to throw away food.

Reported counts range from more than 100 to more than 115 affected stores, spanning major chains and small butcher shops alike. Per BBC reporting, disruptions occurred in Belgium, Estonia, Finland, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden.

Several stores reported settings or temperatures reaching 50°C, the same figure seen in the French incident of 11 to 12 October.

The technical assessment is unambiguous and deserves to lead. As one expert put it: "They got in through internet-facing controllers, end-of-life firmware, and default passwords."

Nobody knows who did this. Claims circulating that the pro-Russian groups NoName057(16) and the Z-Pentest Alliance have taken responsibility for this wave are not supported by official statements. Belgium's Centre for Cybersecurity said on Monday that it was not known who was behind the attacks and that "it may never be determined." Investigations have so far failed to identify who carried them out.

What happened

Who was hit

Belgium appears to have taken the heaviest impact, and Belgian federal prosecutors have opened an investigation.

The method

Attackers reached internet-exposed controllers made by Danfoss and Copeland, then changed settings to shut down cooling or trigger defrost cycles, driving temperatures up. Store managers discovered the damage early in the morning.

Suppliers across multiple countries confirmed the method matched the October attacks. Danfoss said the Dutch incidents were the same kind as those in France, Sabcobel said the same method was used in Belgium, and Kitman said the Estonian case was similar. An Estonian refrigeration supplier said the units attacked there were older Danfoss models.

One divergence worth noting

The entry point was not identical everywhere, and this matters for how organisations should respond.

In Belgium, attackers got into individual supermarkets' systems, not those of refrigeration contractors. In Portugal, the Mosqueteiros group linked incidents at seven Intermarché stores to an attack involving an outside refrigeration service provider.

So two different routes to the same outcome: direct exposure of a store's own controller, and compromise through the contractor who maintains it. An organisation that has secured one path has not necessarily secured the other.

The exposure data

Internet intelligence figures put the problem in context:

• France leads Danfoss StoreView exposures globally, followed by Belgium and the United States.

• 138 exposed instances in Belgium, of which about 68% appear patched.

• 51 in the Netherlands, about 37% patched.

• 50 in Sweden, about 58% patched.

• Only a handful of exposed instances in Luxembourg, Ireland and Estonia.

A UK study counted more than 800 retailer refrigeration and building controllers reachable online, most of them on consumer broadband or cellular links. That last detail explains a great deal. These devices are frequently installed by refrigeration contractors on connections that no corporate IT team ever sees.

The attribution question

This is where care is required, and where the brief circulating about this story overreaches.

What is documented: the Z-Pentest Alliance has a track record of claiming refrigeration attacks throughout 2026. Forescout's hacktivist tracking recorded more than twenty claimed refrigeration attacks in 2026, chiefly against fruit storage, wineries, supermarkets and food processors in Spain and Italy. On 26 April alone, Z-Pentest claimed ten separate attacks.

What is not documented: a verified claim of responsibility by either Z-Pentest or NoName057(16) for this specific November wave, confirmed by an official body.

What official bodies say: Belgium's Centre for Cybersecurity stated attribution may never be determined, and urged operators to take controllers offline. Sweden's National Cybersecurity Centre said it was following the incidents and sharing information with agencies in other Nordic and European countries.

A history of claiming similar attacks makes a group a reasonable suspect. It is not the same as an established attribution, and reporting it as settled would be premature.

The outlier claim

One widely repeated detail deserves scepticism. The owner of a butcher shop in Athens told Greek broadcaster Skai TV that someone hacked a refrigeration unit's temperature control and raised it to 150°C. That figure is far outside anything else reported, rests on a single account, and should be treated as unverified.

Why it matters

This is the second wave, and the method did not need to change. The October attacks on French supermarkets were widely covered, governments issued warnings, and vendors published guidance. Three weeks later the same technique worked across ten countries. That tells you how little of the exposed estate was actually remediated.

The patch rates are the story. About 37% of exposed Dutch instances appear patched. Even in Belgium, the best of the three, roughly a third remain unpatched. These are devices whose existence has been public knowledge since October.

Nobody owns these devices. Refrigeration controllers are installed by contractors, often on consumer broadband or cellular connections, and sit outside corporate IT inventories. The UK figure of 800-plus reachable controllers describes equipment that is nobody's asset in any formal sense.

Small businesses are in scope. Seventeen Dutch butcher shops, a chocolate shop, an IKEA store. A butcher losing a freezer's contents has no security team, no incident response plan and often no idea the controller was online.

Attribution may never arrive, and waiting for it changes nothing. Belgium's own cybersecurity centre has said as much. The remediation is identical whether this is state-aligned hacktivism, criminal nuisance or something else entirely.

Food safety is the real consequence. Spoiled stock is the visible cost. The invisible risk is product that warmed and cooled again without anyone noticing, which is a consumer safety question rather than a security one.

Who is affected

• Retailers and food businesses in the ten reported countries, from major chains to single shops.

• Operators of Danfoss and Copeland controllers, particularly older and end-of-life models.

• Anyone with a refrigeration controller on a contractor-installed internet connection, which is the population most likely not to know it is exposed.

• Refrigeration service providers, implicated as an entry route in the Portuguese cases and now an obvious target.

• Food processors, butchers and cold storage operators, named in Z-Pentest's earlier 2026 claims.

• Consumers, through discarded stock, empty aisles and the safety question above.

What organisations should do

Immediately

1. Take refrigeration and building controllers off the public internet. This is Belgium's Centre for Cybersecurity's direct advice, and it is the only measure that reliably works.

2. Find them first. Check contractor-installed connections, consumer broadband lines and cellular modems. Your corporate network inventory will not list these.

3. Change default passwords on every controller. Default credentials are named as a primary entry route.

4. Identify end-of-life firmware and models. Estonia's affected units were older Danfoss models. Where no patch exists, disconnection is the only option.

5. Apply available firmware updates. With roughly a third to two thirds of exposed devices still unpatched, this remains the gap.

Where remote access is genuinely needed

6. Put it behind a VPN or managed gateway with multi-factor authentication, rather than exposing the controller interface directly.

7. Restrict access to known addresses as an interim step, not an endpoint.

Contractor and supply chain

8. Ask your refrigeration contractor exactly how they connect to your equipment, from where, and with what credentials. The Portuguese cases came through a service provider.

9. Require notification of any remote access changes, and remove accounts for contractors you no longer use.

Detection and operations

10. Alarm on configuration changes, not just on temperature. Setpoint changes and extended defrost cycles are the earliest signal, and in the October French attacks alarms were deliberately suppressed by extending defrost windows.

11. Add an independent temperature check that does not run through the same controller.

12. Brief night and early-morning staff. In this wave, managers discovered the damage at opening.

13. Have a food safety decision process ready. Staff need a clear rule on what gets discarded, documented for regulators and insurers.

Final thoughts

Three weeks after the French attacks made international news, the same technique worked again in ten countries. Nothing was upgraded, no new vulnerability was found, no sophistication was added. The attackers simply ran the same playbook against the large share of the exposed estate that had not been touched since October.

The lesson: the exposure here is not a security flaw, it is an ownership gap. A refrigeration controller is installed by a contractor, connected to whatever internet link is convenient, configured with a default password, and then forgotten by everyone. It does not appear on an asset register. It is not in scope for a penetration test. No one patches it because no one is responsible for it. Attackers found an entire class of internet-connected industrial equipment that sits outside every process an organisation uses to secure things.

The second lesson is about attribution and the temptation to wait for it. Pro-Russian hacktivist groups have claimed similar attacks throughout 2026 and are plausible suspects here. But Belgium's cybersecurity centre has said plainly that who did this may never be established, and the remediation does not depend on the answer. Disconnecting a controller from the internet works regardless of who is scanning for it.

Two things worth doing this week: find every refrigeration and building controller in your estate that has an internet connection, and ask your refrigeration contractor how they reach your equipment.