Refrigeration-system attacks disrupt European supermarkets and medical facilities
Cyberattacks targeting commercial refrigeration controllers have disrupted supermarkets across Europe, with incidents reported in France and at least 10 other countries. The attackers changed refrigeration settings, causing food spoilage at hundreds of stores. French authorities also disclosed that systems used by medical facilities were affected, although there was no evidence that blood products had spoiled.
The activity highlights how internet-exposed operational technology can create physical and business consequences when unauthorized users gain control. Refrigeration systems are essential to food and medical supply chains, and changes to their operating modes or temperatures can damage inventory and, in some reported cases, contribute to fires.
Two waves of incidents
The first reported wave took place overnight from Oct. 11 to 12, 2026, and primarily affected about 700 supermarkets in France. A second wave occurred overnight from Nov. 1 to 2, extending the activity to at least 10 additional European countries and affecting more than 100 to 115 retail locations, according to public reporting summarized by researchers.
Reports said some targeted refrigeration units were heated to as high as 50°C (122°F). The consequences included spoiled food, and some incidents reportedly resulted in fires. The timing raised concerns for retailers preparing for holiday shopping periods, when they need to maintain adequate inventory.
The route used to gain initial access has not been confirmed. Public discussion has pointed to the possibility that affected devices were running vulnerable software or still used manufacturer-provided default credentials, but these remain unverified explanations—not established findings. The distinction matters: an internet-visible device is not necessarily vulnerable or compromised, and exposure data alone cannot identify the cause of an incident.
Internet exposure trends
Using Cortex Xpanse, researchers identified more than 5,000 internet-exposed devices manufactured by companies named in a CERT-FR advisory during Nov. 5–6, 2026. The count covered exposed devices; it did not establish that they were running vulnerable software or had been exploited.
For France, the same research found a marked decline in the number of observed internet-exposed devices over three periods: 1,853 from Oct. 1–15, 558 from Oct. 16–31, and 316 from Nov. 1–6. These measurements indicate a reduction in observed exposure, but they do not show why the numbers changed or establish that every affected system was secured. Censys has separately reported on exposure trends in Europe.
On Nov. 3, the pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility in Telegram posts. The claims have not been verified. CISA issued an advisory on Nov. 5 warning of potential exploitation involving authentication bypass, arbitrary code injection and weak configurations. The available information does not confirm which, if any, of those issues enabled the reported incidents.
Defensive priorities for OT and IoT teams
Organizations operating refrigeration controllers and other operational technology should establish what equipment is reachable from the public internet and whether remote administration is necessary. Teams can review exposure findings against asset inventories, confirm software and firmware status with vendors, and check that default credentials and weak configurations have been eliminated. Remote access should be limited to authorized users and services, with administrative interfaces kept off the public internet wherever feasible.
Monitoring should account for the physical purpose of the equipment, not just conventional IT indicators. Unexpected changes to controller settings, abnormal control-plane traffic and access outside expected maintenance activity warrant investigation. OT teams should also coordinate with facilities and business owners so that incident procedures cover safe operating conditions, inventory protection and escalation when refrigeration performance changes unexpectedly.
Network controls can help reduce risk where systems cannot be promptly updated. Palo Alto Networks describes Cortex Xpanse as a tool for discovering internet-exposed assets, while Device Security provides discovery and visibility across OT and IoT environments, including attention to weak configurations, default credentials and exposed administration. Frontier Virtual Patching with Advanced Threat Prevention is described as inspecting traffic to block exploit attempts and other malicious communications. Such controls complement, rather than replace, secure configuration, vendor remediation and carefully managed access.
For affected or potentially exposed organizations, the key is to validate the state of each controller rather than infer compromise from exposure alone. The incidents demonstrate that cyber risk to operational systems can rapidly become a facilities and supply-chain problem, making coordinated oversight by security, engineering and operations teams essential.
