The cyber attacks affecting supermarket refrigeration systems across Europe on 2 and 3 November were preceded by a period of reconnaissance.
New findings published by Euronews on 7 November 2026 indicate that the cyber incidents affecting supermarket refrigeration systems across Europe on 2 and 3 November were preceded by a period of reconnaissance targeting internet-connected industrial controllers.
Following the unprecedented cyberattack that hit France’s supermarket refrigeration units overnight on 11–12 October, Lupovis, a Scottish Cybersecurity company, set up honeypots, a decoy systems designed to replicate real technologies and attract malicious activity without exposing operational equipment that mimicked vulnerable Danfoss refrigeration control systems.
In the days leading up to the major supermarket strikes, between 20 and 30 October, they recorded 276 total reconnaissance and break-in attempts coming from 91 distinct IP sources, trying out default passwords and known vulnerabilities, against systems associated with Danfoss refrigeration controllers. Activity peaked on 26 October before stopping towards the end of the month. Researchers observed attempts to access Danfoss controller components using factory-default credentials and to probe known vulnerabilities. The activity reportedly included attempts to identify specific controller components, suggesting that the operators were assessing the systems before the attacks.
On 2 and 3 November, the subsequent incidents affected supermarkets in ten European countries and several blood-storage facilities in France. In some cases, attackers manipulated refrigeration settings, raising temperatures to as high as 50°C and forcing businesses to discard perishable products.
Attackers reportedly exploited weaknesses in internet-connected Danfoss AK-SM systems to manipulate temperature controls. Some equipment reached temperatures of 50°C, compromising stored food and creating risks for temperature-sensitive products.
According to Xavier Bellekens, CEO of the Scottish cybersecurity firm Lupovis, a group of hackers with links to the Russian state may be behind the cyberattacks, stating that data and infrastructure patterns, including the use of bulletproof hosting and overlapping IP addressesp, point toward a Russian state-sponsored threat actor. Though, no official national attribution has been finalised, and Russia denies involvement in fridge hacks across Europe.
Why does it matter?
The sequence highlights an important characteristic of cyber-physical operations: the disruption of physical processes may be preceded by systematic reconnaissance of the digital systems controlling them. In this case, the interval between the observed probing activity and the subsequent incidents suggests that identifying exposed controllers, testing credentials and examining vulnerabilities may have formed part of the preparation. However, the available evidence does not establish that every reconnaissance attempt led to a successful intrusion or that all incidents were conducted by the same operators.
The technical weaknesses nevertheless expose a broader problem in operational technology (OT) security. Refrigeration controllers are increasingly connected to the internet to enable remote monitoring, automated temperature regulation and maintenance. When management interfaces are directly exposed, protected by default or weak credentials, or running outdated software, they can provide an entry point into systems whose manipulation has immediate physical consequences. The ability to change temperature settings through legitimate control functions also means that malicious activity may resemble ordinary operational commands, complicating detection.
The refrigeration incidents demonstrate that systems often regarded as routine facilities equipment can become accessible targets when remote connectivity is not accompanied by appropriate security controls. The case highlights the importance of analysing the entire operational sequence of cyber-physical incidents, rather than focusing exclusively on the moment of disruption. It also reinforces the need to extend cybersecurity governance to the interconnected equipment underpinning essential services and supply chains.
As digital connectivity expands across industrial and commercial environments, resilience will depend on treating OT as part of the organisation’s cybersecurity attack surface, clarifying responsibility between operators and manufacturers, and ensuring that regulatory requirements translate into effective protection of physical processes. The central lesson is that the security of the digital systems controlling essential infrastructure is inseparable from the continuity and safety of the services they support.
