The refrigeration cyberattack campaign that hit about 700 French supermarkets on October 11, 2026, is now a multi-country pattern of attacks on critical infrastructure. A second wave struck food businesses in 13 countries on November 2, cold rooms at a contractor for France’s national blood service were set to 110°C (230°F), and three UK meat suppliers were hit through Copeland XWEB controllers. On November 5, five US agencies warned of ongoing attacks on refrigeration and cold chain systems.
SOCRadar has followed each stage as it broke, from the French supermarket cyberattack to the freezer attacks in Belgium, Sweden and Luxembourg and the FBI and CISA refrigeration warning. This analysis links these events, tracing the campaign from the 2025 Danfoss disclosures through its malware-free attack chain and attribution claims to the US – covering military commissary failures, federal warnings, past intrusions by these groups, SOCRadar exposure data, and impacts in Canada and the UK.
The US angle matters more than it first appeared. Freezers at six or more US military commissaries failed overnight in late August, six weeks before the French wave, and the Pentagon now treats those failures as a suspected cyberattack.
Where the Campaign Stands as of November 9, 2026
As of November 9, 2026, the technique is well established; the attribution is not. The table separates what the evidence supports from what remains a lead:
| Assessment | Confidence | Basis |
|---|---|---|
| Attackers raised setpoints and forced defrost on internet-exposed controllers | High | Retailer, contractor and government reporting across France, Belgium, Sweden and the UK |
| Initial access came mainly from default credentials on exposed interfaces | High | Honeypot telemetry and no malware in any public reporting |
| The campaign has reached the UK | High | Copeland confirmed some XWEB products were affected at three meat suppliers |
| The same controller families are exposed in the US, Canada and UK | High | SOCRadar exposure observations, November 4 to 5, 2026 |
| The August US commissary failures belong to the same campaign | Low to moderate | Identical failure mode and timing; cause and controller make unconfirmed |
| One actor carried out every incident | Low | No shared infrastructure or official attribution published |
| NoName057(16) and Z-Pentest carried out the attacks | Low to moderate | Explicit claim in a November 3 video, but no proof of access; posted weeks after the first wave; Z-Pentest’s own post does not claim the large waves |
| The blood service incident is linked to the supermarket waves | Low | Same technique; no technical link published |
US federal investigators are examining the commissary incidents, and Belgian and French prosecutors have opened cases. No government has published indicators of compromise or named a perpetrator.
From Disclosure to Sabotage: How the Refrigeration Attacks Unfolded
The campaign traces back to published security research on supermarket refrigeration controllers. Within weeks of the full write-up in August 2026, the same class of device began failing in the wild. Honeypot data points to default passwords as the main way in, while the disclosed flaws appear largely unused.
| Date | Event |
|---|---|
| March 2025 | Danfoss discloses authentication bypass and command injection flaws in AK-SM 800A controllers, reported by Claroty Team82 |
| August 2025 | Danfoss firmware 4.3.1 fixes the AK-SM 800A flaws |
| December 9, 2025 | CISA, the FBI, NSA and partners including the UK, Canada and Australia issue advisory AA25-343A on pro-Russia hacktivists tampering with exposed HMIs |
| January to October 2026 | Hacktivists claim more than 20 attacks on refrigeration systems, including 10 by Z-Pentest on April 26 alone, per tracking |
| August 9, 2026 | Claroty Team82 publishes its full research on Danfoss AK-SM 800A and Copeland XWEB Pro, noting thousands of reachable interfaces |
| August 26 to 28, 2026 | Freezers at six or more US military commissaries enter defrost overnight |
| October 11 to 12, 2026 | Wave 1: about 700 French stores forced into defrost, with fires, melted equipment and losses in the tens of millions of euros |
| October 12, 2026 | CERT-FR names Danfoss AK-SM and AK-SC and Copeland and Dixell XWEB controllers in an alert |
| October 14, 2026 | Copeland acknowledges an XWEB EVO vulnerability, tells customers to take EVO units offline and migrate to XWEB PRO |
| October 20 to 30, 2026 | Decoy Danfoss controllers log 256 login attempts from 91 sources, mostly with default credentials, peaking October 26 |
| October 29, 2026 | Pentagon reported to be treating the August commissary failures as a suspected cyberattack |
| November 1 to 2, 2026 | Cold rooms at a contractor for France’s blood service (EFS) set from -30°C to 110°C; alarms alert a technician and nothing is lost |
| November 2, 2026 | Wave 2: supermarkets and food businesses hit in 13 countries |
| November 3, 2026 | The EU calls the attacks a deliberate attempt to disrupt the food supply chain |
| November 3 to 4, 2026 | NoName057(16) explicitly claims, with Z-Pentest, attacks on Danfoss and Dixell XWEB equipment in a video, but offers no proof |
| Early November 2026 | Three UK meat suppliers hit through Copeland XWEB controllers |
| November 5, 2026 | CISA, the FBI, HHS, USDA and DOT issue a joint fact sheet on refrigeration and cold chain attacks |
The blood service incident happened the night before the second wave became public and used the same technique. No public technical evidence ties the two to one actor.
Inside the Attack Chain on Refrigeration Controllers
The attackers needed no zero-days and no custom malware, only exposed management interfaces and weak configuration. They also skipped individual display cases and took over the store-level system manager that runs the whole refrigeration estate.
Which Controllers Are Involved
CERT-FR named four controller families after the first wave. SOCRadar’s exposure work adds Carel pCOWeb, which shares the same profile: a web management interface, and sometimes control protocols such as Modbus, reachable from the internet.
| Vendor | Controller | Role in the Campaign |
|---|---|---|
| Danfoss | AK-SM 800A and AK-SM 800 (StoreView interface) | Named by CERT-FR; end-of-life AK-SM 800 units and current units on outdated firmware were hit in France |
| Danfoss | AK-SC 355 | Named by CERT-FR; phased out in 2016 |
| Copeland and Dixell | XWEB, including XWEB 500D EVO | Named by CERT-FR; Copeland confirmed XWEB products were affected in the UK |
| Carel | pCOWeb | Same exposure profile on an old embedded web server with basic authentication; not named in the attacks |
| Copeland | E3 Site Supervisor | Frostbyte10 flaws below firmware 2.31F01; 551 services exposed worldwide; not named in the attacks |
Five Steps, No Malware
- Reconnaissance: attackers locate exposed management interfaces through internet-wide scanning services, which index these devices automatically
- Initial access: they log in with publicly documented factory-default credentials, with no exploit involved
- Manipulation of control: legitimate interface functions raise setpoints far above normal or lock defrost mode on, sometimes after alarms are switched off
- Exit: sessions last minutes, usually between 1:00 and 4:00 a.m. local time, so the damage surfaces when staff arrive
- Publicity: screenshots and claims follow, often exaggerated
The result is spoiled stock and, in some French stores, melted equipment, fires and water damage from sprinklers. Defenders can watch for four signals: unscheduled defrost cycles, setpoints far above operating norms, disabled alarms and interface activity between 1:00 and 4:00 a.m. local time.
Why Default Passwords Mattered More Than the CVEs
The clearest early warning came from decoys. Danfoss AK-SM controllers emulated by deception researchers logged 256 login attempts from 91 sources between October 20 and 30, peaking on October 26, with no comparable activity before October 20. Most attempts used Danfoss’s publicly documented default credentials, others tried to fingerprint controller components, and all were rejected.
The attempts were standard logins, not the CVE-2025-41450 bypass. Follow-up coverage tied the sources to networks previously categorized as bulletproof hosting used by Russian threat actors. Probing ran until October 30, consistent with an effort to collect as many devices as possible before a synchronized wave. Honeypot data is a lead, though, not attribution, and no government agency has published indicators of compromise.
The known vulnerabilities still matter for patching, because they give a second path to the same controllers.
| CVE | Product | Issue | Fixed In |
|---|---|---|---|
| CVE-2025-41450 | Danfoss AK-SM 8xxA | Authentication bypass through a hidden, date-derived “code of the day” (CVSS 8.2) | R4.2 |
| CVE-2025-41451 | Danfoss AK-SM 800A | Authenticated command injection (CVSS 7.6) | 4.3.1 |
| CVE-2025-41452 | Danfoss AK-SM 800A | Management interface disruption (CVSS 5.4) | 4.3.1 |
| CVE-2026-21718 | Copeland XWEB PRO 1.12.1 and earlier | Authentication bypass (CVSS 10) | 1.13 (ICSA-26-057-10) |
| CVE-2025-6519, CVE-2025-52543 to CVE-2025-52551 (Frostbyte10) | Copeland E3 Site Supervisor and E2 | Ten flaws found by Armis that chain to unauthenticated remote code execution as root | E3 firmware 2.31F01; E2 is end of life |
MITRE ATT&CK for ICS Mapping
The mapping below is indicative, based on public reporting of the French and European waves.
| Tactic | Technique | ID | Observed Behavior |
|---|---|---|---|
| Initial Access | Internet Accessible Device | T0883 | Management interfaces answer on public IP addresses |
| Lateral Movement | Default Credentials | T0812 | Logins with published factory-default credentials |
| Execution | Graphical User Interface | T0823 | Changes made through the vendor’s own web interface |
| Inhibit Response Function | Alarm Suppression | T0878 | Alarms disabled before changes in some cases |
| Impair Process Control | Modify Parameter | T0836 | Setpoints raised far above operating norms |
| Impact | Manipulation of Control | T0831 | Defrost mode locked on across store systems |
| Impact | Damage to Property | T0879 | Melted equipment, fires and sprinkler water damage |
| Impact | Loss of Productivity and Revenue | T0828 | Spoiled stock and lost sales |
Attribution: Hacktivist Claims and Competing Theories
No government has attributed the refrigeration attacks as of November 9, 2026. In a video posted on November 3, NoName057(16) explicitly claimed, together with Z-Pentest Alliance, attacks on Danfoss and Dixell XWEB equipment, but offered no proof and referred to the October wave only as “similar incidents”. Z-Pentest’s own November 4 post stopped short of claiming the large waves.
What the Groups Actually Posted
NoName057(16)’s first post on November 3 framed the activity as a “global audit” of critical infrastructure in “at least 20 countries,” listing water systems, power plants, industrial plants, wineries and food storage. It claimed a DDoS attack on danfoss.com, backed only by a website availability check.
On refrigeration, the group said Danfoss had failed to patch after “the first attack on the refrigerators” and that “the refrigeration systems are down again,” strongly implying involvement without saying “we did it.” It also advertised more than 2,500 alleged Danfoss staff and customer login rows on a Dark Web leak site; the credentials in the shared sample match previously leaked credential sets, indicating recycled data rather than a new Danfoss breach.
The leak site lists danfoss.com alongside two French companies, Free and La Poste Mobile, all in the same generic “Username; Password” format. The shared sample also matches previously leaked credential sets, indicating recycled data rather than a new Danfoss breach.
A second NoName057(16) post the same day shared a 47-second “Chronicle of the operation: Danfoss” video tagged #OpFrance. In it, the group explicitly claims responsibility: “We, NoName057(16), in collaboration with Z-Pentest, are delivering a crushing blow to Danfoss and Dixell XWEB equipment,” adding that no malware was needed because they “simply leveraged the systems built in.” It also claims reach into water supply systems, power plants, industrial facilities and food storage sites, and refers to “similar incidents” at hundreds of European locations without directly claiming the October wave. The video offers no proof of access, such as controller screenshots, IP addresses or store names. Its cover misspells the brand and blends Danfoss with Dixell.
Z-Pentest Alliance followed on November 4. It said it has taken over exposed Danfoss and Dixell controllers since early 2026, noted that no one had publicly claimed the large waves and said only that they “strongly resemble” its earlier work. The post mentioned the US commissary failures without claiming them and ignored the blood service incident.
None of these posts carries panel screenshots, IP addresses, store names or timestamps. Every technical detail in them was already public.
Actor Profiles
The groups work as one ecosystem: NoName057(16) supplies reach and propaganda, and Z-Pentest supplies hands-on OT intrusions. Sector16, a smaller Z-Pentest offshoot, is the most focused on the United States.
| Attribute | NoName057(16) | Z-Pentest Alliance | Sector16 |
|---|---|---|---|
| Formed | March 2022 | September 2024, by members of CARR and NoName057(16) | January 2025, through work with Z-Pentest |
| Main activity | DDoS through the DDoSia volunteer toolkit; propaganda | OT intrusions through exposed HMIs and VNC; hack-and-leak; defacements | OT intrusions with default or weak passwords |
| Refrigeration activity | November 3 Danfoss DDoS, credential-leak claim and “Operation Danfoss” video | Claimed 10 refrigeration attacks on April 26, 2026; November 4 post implies the European waves | None found in public reporting |
| US relevance | Named in AA25-343A | Named in AA25-343A; jointly claimed access to a US oil-well system with Sector16 in January 2025 | US prosecutors say it accessed oil pumps and storage tanks in Texas and sites in North Dakota, New York and Pennsylvania |
| Other context | Disrupted by Europol’s Operation Eastwood in July 2025 | Danish intelligence attributed a 2024 waterworks attack to it in December 2025 | A member entered a guilty plea in the US in May 2026; AA25-343A says members may have received indirect Russian government support |
| Claim reliability | Low: generic proof and passive wording about the refrigeration attacks | Mixed: earlier claims came with videos or screenshots; the November 4 post had none | Not applicable to this campaign |
The joint advisory that named these groups describes a closely related method: access through minimally secured VNC connections to HMIs, followed by parameter changes, restarts and disabled alarms. CARR used it against utilities in Muleshoe, Texas, and Tipton, Indiana, in 2024.
A Wider OT Playbook in the Same Channel
SOCRadar reviewed a sample of NoName057(16)’s English-language Telegram posts from October 26 to November 5, 2026. It held six OT intrusion claims in a single week, all against small operators that appear to have been chosen for exposure, not strategic value. None is independently verified.
| Date | Country | Claimed Target | Claimed Action |
|---|---|---|---|
| November 2, 2026 | Germany | Gas-engine combined heat and power plant (Woodward easYgen controller) | Switched to manual mode |
| November 1, 2026 | Germany | Industrial drying plant | Controller hostname changed to the group’s name |
| October 31, 2026 | Italy | Textile filling line reached through exposed VNC | Recipes, scales and passwords changed; alarm triggered |
| October 30, 2026 | Italy | Small hydroelectric plant (Siemens SIMATIC PLC and HMI) | Access to gates, turbine and start/stop controls |
| October 28, 2026 | Italy | Pressure and vacuum tank complex (Digitron panel) | Pressure setpoints and offsets rewritten |
| October 27, 2026 | Italy | Building management system at a private residence (Sauter) | Temperature setpoints shown adjustable to 99°C and 0°C |
These posts report vendor, model and on-screen parameters. The group’s Danfoss posts from the same days carry none of that detail. The sample is partial, so the gap is a limit of the data, not proof.
Other personas run the same playbook and sometimes fabricate results. TwoNet, another pro-Russian group, broke into a water utility honeypot with default credentials and then presented it as a real US water utility.
Competing Hypotheses
| Hypothesis | Basis | Confidence |
|---|---|---|
| Pro-Russian hacktivists (NoName057(16) or Z-Pentest) | Public hints, bulletproof hosting overlap in honeypot data, earlier refrigeration claims; Belgian reporting also points to Russia-linked hackers | Low to moderate |
| Iran-linked actor | One researcher attributed a May attack on an Israeli food plant’s freezers to Iran | Low |
| Semi-amateur criminal actor | Romania’s cyber chief described the attacks as “semi-amateurish” and does not suspect a state | Low |
The pro-Russian hypothesis has support: Z-Pentest specializes in exposed industrial panels, claimed 10 refrigeration intrusions in one day in April 2026, and analysts consider these groups a credible lead. Against it, the hints came weeks after the first wave and after researchers had publicly named the groups, they contain nothing only the perpetrator would know, and Italian investigators have noted inconsistencies.
SOCRadar assesses with low to moderate confidence that the waves overlap with NoName057(16) or Z-Pentest activity, based on NoName057(16)’s explicit but unproven claim in a November 3 video, Z-Pentest’s record of similar refrigeration claims in 2026, matching TTPs, and Russia-linked bulletproof hosting seen in third-party honeypot data. Nothing public ties the blood service incident to any group.
The US Angle: Commissaries, a Federal Warning and Past Intrusions
The US sits at both ends of the refrigeration story. It may have been the campaign’s first target, it now has a five-agency warning on record, and the groups linked to the campaign have reached US critical infrastructure before.
The US Commissary Failures That Came First
Between August 26 and 28, 2026, refrigeration at multiple Defense Commissary Agency (DeCA) stores on US military bases failed almost at once. Fort Huachuca, Arizona, reported that all of its commissary freezers went into defrost overnight and all frozen food spoiled while power stayed on, which rules out a simple outage. Temperatures inside some units reportedly reached about 50°C (122°F).
Installations named in base announcements and military news coverage include Fort Huachuca (Arizona), Fort Irwin (California), F.E. Warren Air Force Base (Wyoming), Naval Station Newport (Rhode Island), Columbus Air Force Base (Mississippi) and Travis Air Force Base (California). Several other bases appear in reports but are not all confirmed.
The Department of Defense first acknowledged only a “possible refrigeration disruption.” On October 29, accounts citing four officials said the Pentagon now treats the failures as a suspected cyberattack and has spoken with French police about the October wave. Army CID’s Cyber Field Office is investigating alongside DeCA and the Defense Criminal Investigative Service (DCIS).
The controller make at the affected stores is unconfirmed. Procurement records for at least one commissary reportedly list a Danfoss control system, and national press accounts say commissaries run Danfoss remote-control systems of the kind flagged as vulnerable. DeCA separately blamed outages at four European commissaries on equipment wear and parts delays.
SOCRadar assesses with low to moderate confidence that the commissary failures belong to this campaign, based on the identical overnight defrost pattern and timing about two and a half weeks after the Danfoss research went public. If confirmed, the United States was the campaign’s first known target.
What the November 5 Federal Warning Says
On November 5, 2026, CISA, the FBI, HHS, USDA and DOT released a joint fact sheet on ongoing attacks against refrigeration and cold chain monitoring systems in grocery and cold storage facilities.
- Threat: attackers can remotely change controller settings and push units into continuous heating and defrost
- Audience: the Healthcare, Chemical, Food and Agriculture, and Transportation sectors
- Access paths: authentication bypass, arbitrary code injection and weak configurations, without saying which one any incident used
- What it leaves out: no vendor, product, victim, attacker or CVE
SOCRadar’s breakdown of the FBI and CISA warning maps its mitigations to CISA’s Cross-Sector Cybersecurity Performance Goals.
The Same Groups Have Reached US Infrastructure Before
The groups named in advisory AA25-343A have a US track record built on the same entry method: exposed HMIs with weak or no passwords.
| Date | Location | Sector | Incident | Actor |
|---|---|---|---|---|
| May 2026 | US federal court | Oil and gas | A Sector16 member pleads guilty; prosecutors say the group accessed oil pumps and storage tanks in Texas and sites in North Dakota, New York and Pennsylvania | Sector16 |
| January 2025 | US oil-well system | Oil and gas | Access shown in a joint video | Claimed by Z-Pentest and Sector16 |
| April 2024 | Tipton, Indiana | Water and electricity | HMI manipulation at the municipal utility | Claimed by CARR |
| January 2024 | Muleshoe, Texas | Water | HMI manipulation caused a water tank overflow | Claimed by CARR |
SOCRadar’s sample of NoName057(16)’s English-language Telegram posts from late October to early November 2026 contained no US claims. The sample is partial, so it neither confirms nor rules out current US targeting.
US water utilities have also faced a separate threat this year. More than 30 Minnesota community water systems were hit in a coordinated attack on operational technology in late July 2026, which reporting tied to Iranian-affiliated hackers without a formal US attribution. No link to the refrigeration campaign has been reported.
US Exposure Observed by SOCRadar, Alongside Canada and the UK
The controller families hit in Europe are reachable from the internet in all three countries, and the wider OT surface that these groups favor is far larger. SOCRadar collected the counts below on November 4 and 5, 2026, without logging in to or interacting with any device. The US holds the largest share in every category except Carel and XWEB EVO, where UK exposure leads.
| System | US | Canada | UK | Total | Weakness |
|---|---|---|---|---|---|
| BACnet/IP building controllers | 6,752 | 1,908 | 150 | 8,810 | Protocol has no built-in authentication; banners leak building names and locations |
| Niagara Fox building automation | 3,115 | 424 | 260 | 3,799 | Leaks station names, internal IP addresses and versions; old 3.x stations seen |
| VNC services with no password (any device) | 376 | 42 | 23 | 441 | Anyone can view and operate the screen; 22 show industrial control screens |
| Carel pCOWeb refrigeration controllers | 20 | 2 | 71 | 93 | Basic authentication on a 2001-era embedded web server |
| Danfoss refrigeration controllers | 50 | 2 | 6 | 58 | Publicly documented default login |
| Copeland and Dixell XWEB EVO | 3 | 0 | 26 | 29 | Vendor-acknowledged EVO vulnerability; family named by CERT-FR |
Three patterns stand out:
- Vendor mix differs by country: Danfoss exposure concentrates in the US, largely on business ISP connections, while XWEB EVO and Carel exposure concentrates in the UK, so a national assessment has to cover every vendor family
- The largest risk sits in the wider OT estate: password-less VNC and BACnet need no credentials at all, and BACnet runs HVAC in hospitals, data centers, schools and retail
- Decoys inflate raw numbers: about 29% of StoreView results worldwide are honeypots, more in North America, and Niagara stations also appear as BACnet devices, so totals are an upper bound
Siemens S7 PLC and SIMATIC HMI results in the three countries were mostly decoys on hosting providers. Exposed does not mean vulnerable or compromised, and default passwords cannot be counted without logging in.
Ranking the US Exposure
SOCRadar ranked the US findings by how easy each weakness is to use, the physical consequence, how strongly the evidence points to a real system and whether the technique has hit US targets before.
| Rank | Finding | US Count | Risk | Confidence |
|---|---|---|---|---|
| 1 | VNC services with no password, some showing industrial control screens | 376 services (20 showing control screens) | Critical | High for ISP-hosted systems; share that are control systems unknown |
| 2 | Refrigeration controllers on default or outdated settings | 50 Danfoss, 20 Carel, 3 XWEB EVO | High | High |
| 3 | Building automation exposure | 6,752 BACnet/IP, 3,115 Niagara Fox | High | Medium |
| 4 | Web-reachable HMI panels (Siemens SIMATIC and others) | About 7 plausibly real SIMATIC panels | Medium | Low to moderate |
| 5 | Claimed Danfoss credential leak | 2,500+ alleged rows, not verified | Medium | Low |
| 6 | Siemens S7 PLCs | 45 results, mostly decoys | Medium, High if real | Low |
Password-less VNC ranks first because it needs no credentials or exploit and is the method behind the Muleshoe and Tipton incidents. Refrigeration controllers rank second because this device family was hit in Europe, its default login is public and decoys logged 256 default-login attempts in late October. BACnet/IP has no built-in authentication and runs HVAC in US hospitals, data centers, schools and retail.
Generator controllers, DNP3, EtherNet/IP and Unitronics devices, which matter for US water and energy, have not yet been assessed.
Exposure Kept Rising Between the Waves
The first wave did not shrink the global attack surface. After a 71% drop in French exposure, the worldwide count of exposed controllers kept climbing until the second wave. One internet-wide scan then measured a 53% drop in exposed StoreView and XWEB controllers by November 5, using a different method from SOCRadar’s counts.
Firmware age is the sharper risk indicator. On November 4, an independent tracker mapped 4,754 StoreView devices with honeypots removed: about 55% ran fully patched firmware (4.3.1 or later), while about 40% (1,917 devices) remained below 4.2. Two in five exposed devices still run firmware with known flaws, more than a year after fixes shipped.
What a Successful Attack Could Mean in the US
The most likely outcome of a successful attack in the US is local and temporary: spoiled stock, damaged equipment and clean-up costs at individual sites. A regional food or cold chain disruption becomes possible if one contractor’s access is abused across many sites, as happened in France. Serious safety consequences are unlikely, but possible where a site lacks independent protection.
This is SOCRadar’s analytic judgment based on past incidents, not a forecast. The losses so far range from discarded stock to about $300,000 of food at one Swedish grocery warehouse and tens of millions of euros across French retailers, and the setting changes themselves could be reversed within hours once someone noticed.
Impact by Sector
Severity below reflects the potential consequence if an attack goes badly, not its probability.
| Sector | Likely Impact | Worst Realistic Case | Severity |
|---|---|---|---|
| Water and wastewater | Overflow, equipment damage, service interruption | Chemical dosing changed, as in Oldsmar, Florida, in 2021 | High if it goes wrong |
| Backup power and small generation | Local loss of generation | Hospital or data center backup fails during a grid event | High if it goes wrong |
| Food retail and cold storage | Spoiled stock, fire or water damage, empty shelves locally | Hundreds of stores in one region at once | Medium |
| Pharmacy, hospital and blood bank storage | Products quarantined or lost | Loss of irreplaceable samples or vaccines | Medium |
| Building automation | Comfort complaints, equipment strain | Data center or laboratory cooling loss | Medium |
| Manufacturing lines | Scrap, downtime, equipment damage | Worker injury where safety depends on the HMI | Medium |
| Agriculture and grain handling | Spoiled or over-dried grain | Dryer fire without an independent high-limit cutoff | Medium |
| Military and government sites | Food loss, logistics disruption | Small damage with large symbolic value | Low to medium |
How Likely Each Scenario Is
| Scenario | Likelihood | Why |
|---|---|---|
| Intrusion at individual US sites | High | Exposure exists, the method is proven and the tools are trivial |
| Multi-site food or cold chain disruption in one region | Moderate | Requires shared access, as in France |
| Regional shortages or grid-level effects | Low | Reachable assets are small and spread out |
| Public health or safety-of-life consequences | Low, but not zero | Water chemistry, backup power and unprotected machinery |
What Turns a Nuisance Into a Crisis
- Shared access: one contractor, remote support platform or reused password across hundreds of sites
- No independent safeguards: no hardware high-limit cutoff, no alarm outside the controller and no manual fallback
- Overnight timing: changes made between 1:00 and 4:00 a.m. local time would roll across US time zones
- Public narrative: exaggerated claims can draw attention far beyond the actual damage
Recommendations for Retailers, Cold Chain Operators and Contractors
Removing controllers from the public internet is the single most effective step, and it is the primary advice from CERT-FR and Germany’s BSI. The remaining actions close the gaps the campaign has exploited so far, and US operators can line them up with the November 5 federal fact sheet.
- Take management interfaces off the internet: no controller should answer on a public IP address; allow access only through a VPN or a secured network
- Replace default and shared credentials: change factory-default and contractor-shared passwords on every controller and enable MFA wherever the platform supports it
- Update or retire firmware: move Danfoss AK-SM to 4.3.1 or later, Copeland XWEB PRO to 1.13 or later and Copeland E3 to 2.31F01 or later; take XWEB EVO units offline and migrate, per Copeland’s October 14 bulletin; replace or isolate end-of-life AK-SM 800 and AK-SC 355 units
- Close remote screen and building automation ports: block VNC (5900 to 5902), BACnet/IP (47808) and Niagara Fox (1911 and 4911) at the internet edge, use a VPN or BACnet Secure Connect and retire unsupported Niagara 3.x stations
- Segment OT networks: separate refrigeration and building controllers from corporate and point-of-sale networks
- Audit contractor access: inventory every remote access path held by refrigeration and building contractors, especially those serving chains across several states, remove shared accounts and rotate Danfoss service portal and remote-service passwords given the claimed credential leak
- Add independent safeguards: fit hardware high-limit cutoffs for temperature and pressure, send alarms to staff by phone or SMS from outside the controller and rehearse manual operation
- Monitor behavior and timing: alert on unscheduled defrost, abnormal setpoints, disabled alarms and logins between 1:00 and 4:00 a.m. in each site’s local time, since an overnight wave would roll across US time zones
- Watch your own perimeter: scan owned IP ranges continuously and alert on any new public listener from refrigeration or building controllers
- Report incidents: contact CISA or the FBI’s IC3 in the US (and HHS for healthcare organizations), the NCSC in the UK or the Canadian Centre for Cyber Security, and never connect to exposed devices you do not own
Tracking Exposed OT With SOCRadar
SOCRadar helps teams find and close the OT exposure behind these attacks:
- Attack Surface Management: discovers internet-facing assets, including refrigeration and building controller interfaces, and alerts when a new one appears on your ranges
- Dark Web Monitoring: flags credential dumps such as the claimed Danfoss leak
- Cyber Threat Intelligence: tracks hacktivist channels and surfaces OT claims against your sector early
- Supply Chain Intelligence: extends the same visibility to the contractors who hold remote access to your sites
Frequently Asked Questions
How Did Attackers Break Into Supermarket Refrigeration Systems?
Attackers logged in to internet-exposed refrigeration controller interfaces with publicly documented factory-default credentials. Once inside, they used normal interface functions to raise temperature setpoints and lock defrost mode on, sometimes after disabling alarms. No malware or exploit was involved, and most sessions took place between 1:00 and 4:00 a.m. local time.
Were US Military Commissaries Hit by the Same Attackers?
US military commissaries may have been the campaign’s first targets, but the link is unconfirmed. Freezers at six or more commissaries went into defrost overnight between August 26 and 28, 2026. As of November 9, 2026, the Pentagon treats the failures as a suspected cyberattack, and Army CID, DeCA and DCIS are investigating.
Did NoName057(16) or Z-Pentest Claim the Refrigeration Attacks?
Yes, but without proof. In a video posted on November 3, 2026, NoName057(16) explicitly claimed, “in collaboration with Z-Pentest,” attacks on Danfoss and Dixell XWEB refrigeration equipment, saying no malware was needed because they “simply leveraged the systems built in.” The video refers to the October wave only as “similar incidents” and offers no evidence of access, such as controller screenshots, IP addresses or store names. Z-Pentest’s own written post on November 4 stopped short of claiming the large waves, saying only that they resembled its earlier work. As of November 9, 2026, no government has attributed the campaign; the November 5 US joint fact sheet names no attackers, and French and Belgian investigations are ongoing.
Are Refrigeration Controllers in the UK and Canada at Risk?
UK and Canadian operators run the same controller families hit in Europe. SOCRadar observed 26 XWEB EVO and 71 Carel pCOWeb interfaces exposed in the UK, plus thousands of BACnet and Niagara building controllers across both countries. Three UK meat suppliers have already been hit through Copeland XWEB controllers.
Are US Grocery Stores and Pharmacies at Risk?
US grocery stores and pharmacies run the same controller families attacked in Europe. On November 5, 2026, SOCRadar observed 50 Danfoss, 20 Carel and three XWEB EVO refrigeration interfaces exposed in the US. No civilian US incident has been reported as of November 9, 2026, but five federal agencies warned of ongoing attacks on November 5.
How Can Operators Tell if a Refrigeration Controller Was Tampered With?
Signs of tampering include defrost cycles outside the programmed schedule, setpoints far above operating norms, alarms disabled with no staff on site and management interface logins between 1:00 and 4:00 a.m. local time. Operators should also route alarms through a channel the controller cannot silence, such as phone or SMS.
Source: SOCRadar · 2026-11-09