Unit 42 Details Reported Attacks on European Refrigeration Systems
Summary
Unit 42 describes reported attacks that set European refrigeration units to defrost, affecting supermarkets and medical facilities. It also found over 5,000 internet-exposed devices from manufacturers named in a CERT-FR advisory; exposure does not establish that devices
Key points
- The article reports an initial wave affecting approximately 700 French supermarkets on Oct. 11–12, 2026, followed by activity across at least 10 more European countries on Nov. 1–2, affecting over 100–115 retail locations.
- Reported effects included spoiled food, refrigeration temperatures as high as 50°C, and fires in some cases; French authorities also disclosed impacts to medical-facility refrigeration, with no evidence of spoiled blood products.
- The initial access method remains unconfirmed. Speculation cited in the article includes vulnerable software or manufacturer-default credentials.
- Unit 42 identified over 5,000 internet-exposed devices made by companies listed in a CERT-FR advisory; the count does not establish that those devices ran vulnerable software.
- In France, Unit 42 counted 1,853 exposed devices from Oct. 1–15, 558 from Oct. 16–31, and 316 from Nov. 1–6, 2026.
- NoName057(16) and Z-Pentest claimed responsibility in Telegram posts, but their claims remain unverified. CISA warned of potential exploitation involving authentication bypass, arbitrary code injection, and weak configurations.
Article Details
- Event Type
- Cyberattacks targeting refrigeration systems at European supermarkets and medical facilities.
- Impact
- Threat actors gained unauthorized access to refrigeration controllers and set them to defrost mode. Multiple sources reported that some units reached temperatures as high as 50°C, with spoiled food at hundreds of supermarket locations and fires in some cases. French authorities disclosed that medical-facility refrigeration systems were also affected, but the article reports no evidence that blood products were spoiled. NoName057(16) and Z-Pentest claimed responsibility; those claims remain unverified.
Threat Actors
Vendors
Products
Advanced Threat PreventionComplementing this visibility, Frontier Virtual Patching with Advanced Threat Prevention inspects network traffic inline to block exploit attempts, command-and-control communication, and arbitrary code injection in realCortex XpanseHere we provide a high-level overview of the attacks based on public reporting and explore insights on device exposure by country, based on our findings using Cortex Xpanse.Deep and Dark Web ServiceOrganizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.Device SecurityDevice Security is designed to provide continuous discovery, risk assessment, and protocol-level visibility across OT and IoT infrastructure, identifying weak configurations, default credentials, exposed administrativeFrontier Virtual PatchingComplementing this visibility, Frontier Virtual Patching with Advanced Threat Prevention inspects network traffic inline to block exploit attempts, command-and-control communication, and arbitrary code injection in realUnit 42 Continuous Frontier AI DefenseUnit 42 Continuous Frontier AI Defense is an offensive security service designed to assist organizations with continuously discovering hidden and unknown exposures in dynamic environments, validate real-worldUnit 42 Incident ResponseThe Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.Unit 42 Threat Intel ServicesOrganizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.