A wave of attacks on refrigeration controllers in stores across Europe may be a sign of more to come, experts warn, pointing to other remotely managed devices, from fuel stations to gates and air conditioning.
What happened on the night of 1 to 2 November
According to reports from several countries, attackers remotely changed the settings of refrigeration controllers in supermarkets: they switched them to defrost mode or set the temperature to around 50°C. Stores in Belgium, Luxembourg, Sweden, Ireland, Estonia and the Netherlands were among those affected. Some chains had to throw away food. Earlier, on the night of 11 to 12 October, a similar attack hit around 700 stores in France.
The attacks targeted controllers made, among others, by the Danish manufacturer Danfoss, which issued software updates. Experts note that the method does not require malware – access to the panel, which is designed for technicians to service equipment remotely, is enough.
What Forescout found
Forescout (the Vedere Labs team) published an analysis on 22 October showing that 12,976 refrigeration management services are available online, running on 6,017 public IP addresses in 99 countries. Since January 2026, the company has recorded more than 20 claimed attacks on refrigeration systems. The most active were reportedly pro-Slavic… or, more precisely, pro-Russian groups Z-Pentest Alliance and NoName057(16).
Analysts stress that the problem does not end with supermarkets. The same solutions are used in food processing plants, wineries, fruit cold stores, farms and hospitals. In the past, similar attacks hit stores in Russia and Israel – in 2022, 16 Russian and 40 Israeli outlets, according to a Danfoss bulletin.
Next targets, according to experts
Experts quoted by “Rzeczpospolita” warn that this is only the beginning and point to a long list of potential targets, including fuel stations, gates and air conditioners – anywhere devices are remotely managed and connected to the internet without proper safeguards. A detailed list requires confirmation in the full text.
EU institutions described the attacks as a deliberate attempt to disrupt the food supply chain, although the head of Romania’s cybersecurity agency called them “semi-amateur”. No perpetrators have been publicly identified.
Poland
Forescout’s analysis shows that Poland ranks fifth in the number of exposed interfaces – we described the details in our article about Polish store fridges vulnerable to attacks. Experts’ recommendations apply to all industries: take control panels off the public internet, change passwords, enable multi-factor authentication, keep software updated and separate control systems from the rest of the company network.
