Two pro-Russian hacker groups — NoName057(16) and Z-Pentest Alliance — have claimed joint responsibility for a series of cyberattacks on refrigeration and freezer systems in European supermarkets. The statements appeared on their Telegram channels, but the posts and the channels themselves were soon deleted.
According to cybersecurity experts, the groups claimed they had attacked equipment made by the Danish company Danfoss and the Italian firm Dixell (part of Copeland). They said they did not use sophisticated malware, but instead exploited built-in features of the control systems — remotely switching units into defrost mode or raising temperatures to 50–55 °C. NoName057(16) also published a sample from a database containing login credentials and passwords of Danfoss employees and customers.
The attacks came in waves. In mid-October, hundreds of stores in France belonging to the Coopérative U, Intermarché, Netto, Carrefour and other chains were affected — temperatures in refrigerators rose to 50 °C, and products worth millions of euros were spoiled. On the night of 2 November, similar incidents were recorded in Belgium (Delhaize, Carrefour, Spar, and even IKEA), Luxembourg, Sweden, Finland, Ireland, the Netherlands, Estonia and several other countries. In some cases, dozens of stores were affected in a single country.
Stores were forced to remove chilled and frozen goods from sale and discard them. Medical refrigeration equipment in France (blood storage facilities) was also affected, although losses there were successfully prevented.
European authorities and law enforcement have not yet officially confirmed the involvement of these specific groups. Cybersecurity experts note that the claims may have been an attempt to take credit for attacks carried out by others, after media reports began discussing a possible Russian connection. At the same time, infrastructure previously used in the reconnaissance of these systems had been linked to Russian hacking operations. The U.S. Department of Justice had earlier associated both groups with the ecosystem connected to the GRU-funded organisation Cyber Army of Russia Reborn.
Specialists emphasise that such attacks on operational technology are relatively simple from a technical standpoint, but produce a significant psychological and economic impact. Many refrigeration systems in Europe still run outdated software with known vulnerabilities.
European officials have already described the incidents as a deliberate attempt to disrupt food supply chains and undermine consumer confidence. Investigations are ongoing in several countries.
