Shortly after midnight on Sunday 11 October 2026, someone remotely changed the settings of the refrigeration systems in hundreds of French supermarkets. Staff arriving on Monday morning found cabinets and freezers at up to 50°C and stock that had to be thrown away: at least 350 stores by Reuters' count, about 700 according to France's Economy Minister. Three weeks later, in the night of 1 to 2 November, the same thing happened across Europe, from Belgium to Sweden and from Portugal to Sicily.
It was not the first time. In August, freezers at several US military commissaries had failed in the middle of the night, and the Pentagon now treats those failures as a suspected cyberattack. In the spring, according to the firm that handled the response, an Iran-linked group had sabotaged the refrigeration of an Israeli food plant, destroying three compressors. Back in 2022, Danfoss says, stores in Russia and Israel were hit.
Isolated incidents, made possible by vulnerable equipment left online, or an international sabotage campaign against the food supply? That is the question we put to BackBox AI and its Threat Hunter profile. The answers, and the sources they rest on, are in an interactive dashboard that we will update with every new research cycle.
One question, many sources, no shortcuts
The Threat Hunter worked through three research cycles on 3 November, using public sources only: CERT alerts, vendor advisories, court records, security research and press coverage in about ten languages. Every source went into a ledger with an identifier, a type, a reliability grade and a verification status. Every incident, actor hypothesis and controller family received a stable identifier that later cycles will keep. The first cycle built the international picture; the second focused on Italy, which was being hit at that very moment; the third went back to the original sources and followed new leads, from Germany to attack code published online.
As in our investigation into the October protests, every statement carries a status. A verified fact rests on an official or primary source, or on several independent outlets. A reported item has a single credible source behind it. A hypothesis is an inference, and it says who holds it. The dashboard shows these three statuses on every line, because in a story full of inflated figures and hasty attributions, the difference between "this happened" and "someone says this happened" is the work itself.
Before publication the sources were checked against the originals wherever they could be reached, and the picture was brought up to date with the developments of the following hours.
What happened
The register holds eleven incidents since 2022. Read in order, they tell the story of an old weakness that became a mass problem within weeks.
The precedents. In October 2025 Danfoss, one of the main makers of controllers for commercial refrigeration, disclosed that sixteen Russian supermarkets running its AK-SM 800 system manager had been attacked at the start of the war in Ukraine, and that forty Israeli stores, none with a proper firewall or VPN, had been hacked in 2022. In December 2025 the US Justice Department charged the pro-Russian group CARR, which it describes as founded and directed by Russian military intelligence, with an attack on a Los Angeles meat processing plant in November 2024 that spoiled thousands of pounds of meat and triggered an ammonia leak.
Israel, spring 2026. The most destructive attack in the register is documented by Profero, the firm that handled the incident response. At a food plant the attackers rewrote the setpoints, protection thresholds and alarm limits of one CO2 refrigeration system, wiped the configuration of a second one and pinned its valves open, destroying three compressors; on the corporate network, a remote-access tool with a disk-wiping module was waiting. Profero attributes the operation to Cyber Isnaad Front, a hacktivist-branded group that it ties with high confidence to a company close to Iran's Revolutionary Guards. In October the same group released a video about its Israeli attacks, including one on a chain of kosher grocery stores.
United States, August. On 26 and 27 August at least six military commissaries announced overnight freezer failures; at Fort Huachuca, Arizona, every freezer had gone into defrost with no power cut. By late October the Pentagon was treating the failures as a suspected cyberattack. Two people familiar with the matter pointed to Iran-linked hackers, and two former officials told NPR that some evidence points that way, though not with high confidence. As for the equipment, the presence of Danfoss controllers at the affected bases says little: the inventory of the agency that runs the commissaries lists them at 80 of 185 stores, and one of the affected commissaries uses another vendor.
France, October. This is the attack that made the problem public. In the night of 11 to 12 October stores of every major chain were hit, from Intermarché to Carrefour and from Coopérative U to Monoprix. CERT-FR confirmed numerous compromises of Danfoss controllers and, from 13 October, of Copeland and Dixell XWEB supervisors; the chief executive of Les Mousquetaires put the damage at tens of millions of euros in a single day. The Paris prosecutor opened an investigation. Nobody claimed the attack and nobody asked for a ransom.
Europe, November. In the night of 1 to 2 November the same kind of attack struck again, this time in Belgium, with at least 72 sites including more than 40 Delhaize stores, and then in Luxembourg, the Netherlands, Sweden (30 stores), Estonia, Ireland, Portugal and Italy. In Germany operators and police confirmed at least seven sites in four states, among them two CAP markets, a REWE and two Edeka stores, and investigations are under way in Oldenburg and Landshut; in the United Kingdom the NCSC confirmed a couple of cases with minimal impact at small meat processors. Cases in Finland, Romania and Greece were still unconfirmed on 3 November. The chains' and authorities' own figures add up to about 170 sites, Italy included; there is no official total. The European Commission called the attacks a deliberate attempt to disrupt the food supply chain.
There is also a parallel thread, less visible but telling. According to Forescout, since January 2026 pro-Russian hacktivist groups, the most active being Z-Pentest Alliance and NoName057(16), have claimed more than twenty attacks on the refrigeration of fruit stores, wineries and supermarkets in Spain, Italy and other European countries, changing temperature and defrost settings through panels reachable from the internet. The individual claims are unverified, but the technique is the same as in the two mass nights. One thread leads back to CARR, which the US Justice Department says is also known as Z-Pentest. On the GRU's role, however, the official sources disagree: the US advisory says Z-Pentest Alliance operates without GRU involvement, while the British government says it is at least linked to a Russian military intelligence unit.
How you attack a refrigerator
Behind a supermarket's display cabinets there is almost always a supervisory controller: a small computer that sets temperatures and defrost cycles, collects alarms and forwards them to the maintenance company. To make servicing easier, many of them can be reached from the internet, often through the store's own line or a cellular router, and some still use factory passwords. October's scans count thousands. ONYPHE found 6,212 IP addresses exposing a Danfoss StoreView interface in 95 countries, 2,836 of them in France, and 1,960 exposing a Copeland XWEB EVO supervisor, a generation that went out of support in March 2026 and will get no more fixes; Forescout counts 12,976 exposed services on 6,017 addresses across ten product families. After the attack France disconnected fast: according to Censys the exposed Danfoss panels in the country fell from 1,825 to 537 in three days, with patched and outdated firmware dropping alike, a sign that operators unplugged them rather than updating them. Many remain online, though: on 3 November an independent tracker counted about 2,100 reachable StoreView panels worldwide.
No malware is needed. Whoever gets into the administration interface can do what a technician does: take a freezer from -22 to +50 degrees, force a defrost or stretch it from one hour to eight, widen the alarm thresholds or switch the alarms off. The compressor stops cooling, the heaters warm the cabinet and, if the night alarm stays silent, the damage is found at opening time. MITRE ATT&CK for ICS has names for every step: internet-accessible device, default credentials, modify parameter, change operating mode, modify alarm settings, alarm suppression.
The vendors had already fixed many flaws. The Danfoss AK-SM 800A had a hidden "code of the day" derived from the device's date, fixed in 2025; Copeland's XWEB Pro had 23 vulnerabilities, fixed in February 2026; the Site Supervisor line had an administrator account whose password changed every day in a predictable way. For unpatched Danfoss units, the path then got shorter right after the French attack: on 13 October a proof-of-concept kit for the three 2025 flaws appeared online, the next day a lab published the code-of-the-day algorithm, and from 19 October the CVE records flag the kit as a public exploit. Three weeks before the November wave, getting into an unpatched AK-SM 800A was within anyone's reach. On 21 October, however, France's cybersecurity agency ANSSI told the Senate that the French attack needed no published vulnerability: elementary security failures were enough, interfaces exposed directly on the internet and weak passwords. The evidence from the rest of Europe points the same way. Dutch victims were still on factory passwords, the Swedish stores hit had equipment connected outside the chains' central network, in Estonia the one store not yet moved to the new system was the one attacked, in Romania exposed cellular routers are mentioned, and in Germany the AWO, which runs one of the markets hit, says the attack came through the company that maintains its cooling remotely.
Italy
In Italy the wave arrived the same night, between 3 and 4 a.m. on Monday 2 November. In Sicily, the regional delegate of the retailers' federation Federdistribuzione counts about twenty stores across the provinces of Palermo, Catania and Ragusa; the cases named by the companies come to about ten: at least four stores of a franchised Coop operator, three Conad and three franchised Decò stores. Conad also reported two stores in Veneto. At Silvi Marina, in Abruzzo, a supermarket's cabinets were set to an impossible 150 degrees and reached 40 before the alarm brought in the technicians. In Sassari two supermarkets of a local chain rose to about 15 degrees: the Sardinian press calls it a possible case, while an ANSA dispatch places it on the night of 2 to 3 November, which would make it a second Italian night, still unconfirmed.
The attack went beyond retail. In Tuscany a public-private caterer that prepares 1.8 million meals a year for school, company and hospital canteens detected an anomaly in its refrigeration control systems and contained it; it is the only incident notification under the NIS rules that ACN, Italy's national cybersecurity agency, has received. In Emilia-Romagna the agency itself found an attack, not yet notified, on a frozen-food producer.
The victims describe the same ways in as elsewhere. An area manager of the Coop operator hit in Palermo says the attackers connected to the company VPN and set units that should hold between -18 and -25 to 50 degrees, while the night alarm never went off. The Federdistribuzione delegate speaks of entry through the call centres that run remote management, and of direct access to the units' IP addresses; his group's own stores were untouched, while three franchised stores that had not applied the prescribed protocols were hit. The Prime Minister's office speaks of few commercial units hit, mostly still on obsolete security systems with exposed interfaces and weak authentication, and says no health risk to citizens has emerged.
The most important question for Italy is still open: which equipment was hit. No public source names the vendor or the model, and the main chains say they do not use Danfoss software. The obvious candidate is the Copeland XWEB EVO, of which Italy has the largest exposed fleet in the world, but it remains a hypothesis: Greece and Spain, which also have sizeable EVO fleets, saw isolated cases at most. The answer will have to come from ACN and the postal police. Meanwhile ACN has re-issued its 13 October bulletin with urgent checks for the cold chain, the Prime Minister's office has met with the Agriculture Minister, ACN and the intelligence chiefs, and the parliamentary intelligence committee had hearings of the AISI and ACN directors on its calendar for 3 and 4 November, scheduled before the attacks. The Interior Minister spoke of an initiative presumably coordinated at European level, while admitting he had no updated data: a political assessment, not an attribution.
A campaign, or opportunism?
The evidence does not support either thesis in its purest form, and the answer is best given claim by claim, because each part rests on different ground.
- Each wave was a coordinated operation. Hundreds of stores of different chains, with equipment from several vendors, altered in the same hours: we hold this with high confidence for France and with moderate-to-high confidence for November, where a few isolated cases may be the work of imitators.
- It is not extortion. No ransom demand anywhere: the damage is done before anyone could pay. High confidence.
- The method does not identify an actor. Pro-Russian hacktivists claim it in Europe, an Iran-linked group used a more destructive version in Israel, and anyone with a scanner can do it. High confidence.
- The same actor in October and November? Possibly, with low-to-moderate confidence: the method is identical, but by November it was public knowledge, exploit code for unpatched Danfoss units had circulated since mid-October, and no technical indicator links the two nights.
- One campaign, from Israel to Europe? It is the most compelling reading, but the evidence is thin: the account of the responder to the Israeli incident, an anonymous suspicion of Iran that concerns only the US commissaries, and no technical link at all. Low confidence.
- A state behind the European attacks? Insufficient information. No government has attributed the attacks, nobody has claimed them, and Belgium's cybersecurity centre has said the authors may never be identified.
On the question of who, the dashboard weighs seven hypotheses, from Iran to GRU-linked groups, from hacktivists to imitators, down to a lone actor, which Sophos considers the second most plausible scenario. The honest picture today is that no hypothesis leads for the European waves. Iran has the only suspicion voiced by officials, but it concerns the United States; the pro-Russian ecosystem has the closest repertoire, but its groups claim what they do, while the October and November nights went unclaimed. The correlation matrix shows, incident by incident, what matches and what does not.
A dashboard that will follow the investigation
The dashboard brings the whole investigation together: the key figures; the incident register, with each statement and its status; a map of where the waves hit and where large exposed fleets had no confirmed case; the timeline since 2022; the correlation matrix; the actor hypotheses with their confidence for each incident; the ATT&CK techniques; the controllers with their vulnerabilities and exposure; the indicators of compromise published for the Israeli plant; the open questions; and a searchable ledger of 111 sources. Every item links to its sources, and every source lists the places in the dashboard that cite it.
It is built to grow. With each research cycle the BackBox AI workspace will produce a new database, and a comparison tool will list the new or changed records, which go through the same checks before they reach the dashboard. Identifiers never change, a superseded record stays visible with the reason, and every version has its own changelog entry. The next cycles start from the open questions: how the attackers got in, country by country; which equipment was hit in Italy; whether there will be a third night.
Where open sources stop
No investigator has published technical indicators for the attacks in France, Europe or the United States, so the links between incidents rest on behaviour, timing and statements, not on shared infrastructure. Several sources are paywalled and were read through the outlets that quote them; first-day figures keep being revised, and November's will be too. The absence of any claim is something to watch, not proof of anything.
The dashboard names companies, institutions and roles, not people: defendants and employees quoted in the press stay anonymous, and small businesses are described, not named. It is not an attribution tool and it is not evidence for court, but a reasoned picture of what is public, with the degree of certainty of each statement.
Who it is for, and what to do now
For anyone running supermarkets, warehouses, canteens or food plants, the practical lesson is cheap to apply. Take the controllers off the internet, including those a maintainer connected through a cellular router; allow remote access only through a VPN with multi-factor authentication and separate accounts; change factory passwords; compare the running configuration with the authorised one every day, starting with setpoints, defrost and alarms; and add a temperature probe that is independent of the supervision platform, because it is the one check an attacker cannot rewrite. These are the measures CERT-FR and ACN recommend, and the dashboard lists them one by one.
For analysts, CERTs and journalists we offer a reproducible, up-to-date record in which every figure has a source and every attribution has a confidence level. If you need to follow the threats that reach your sector, or to see how much of your infrastructure is visible from the internet, get in touch.
Updates
- 3 November 2026, 18:00 UTC. First publication, with version 1.0 of the dashboard data.