Key Takeaways
- Expanded refrigeration system attacks took place in early November across multiple European countries roughly simultaneously.
- Internet-accessible, potentially vulnerable control systems are assessed as the likely vector enabling actions.
- Authorities and policymakers must assess overall exposure and coordinate responses to minimize societal risk to cold chains and related critical infrastructure.
Summary
Multiple media outlets reported technically similar attacks against refrigeration control systems in supermarket environments on November 2 2026. Identified incidents include victims in Sweden, Finland, Belgium, Estonia, and Ireland. This comes after similar activity in France in October 2026, and potentially related activity in the US against the Defense Commissary Agency (DeCA). Despite technical similarities across all events, insufficient evidence exists at this time to link these to a single actor.
Expanded Activity & Dataminr Alert
Overnight from November 1 to 2 2026, supermarkets and related entities across multiple countries experienced control system interference, including Sweden, Finland, Belgium, Ireland, and Estonia. Potential attacks were also reported in Luxembourg and Netherlands, but less information is available on these incidents. The events come several weeks after similar incidents across multiple retailers in France, and just after US authorities indicated incidents impacting DeCA stores in August were being investigated as a cyber incident.
The latest incidents, although appearing to impact a handful of retailers within each impacted company instead of mass exploitation across entire supermarket chains, represents a significant increase in geographic reach. None of these incidents, from the DeCA events through the most recent attacks, have been attributed to a specific adversary. Notably, no ransom or extortion demands have been tied to any of these events, nor have any “hacktivist” personas claimed responsibility for the disruption.
Common Attack Vectors & Impacts
Although evidence is still emerging as of this writing, initial analysis indicates both similar attack vectors and impacts as earlier refrigeration control system incidents. For the former, internet-accessible control systems appear to be responsible for both access and adversary actions. The specific technology targeted in these most recent attacks is unknown. The French incident largely (although not exclusively) relied on targeting accessible and unpatched or end of life controllers from Danfoss. A review of commercial internet scanning data shows thousands of similar devices remain internet accessible, including up to dozens in each of the impacted countries in this current incident.
As to impact, the earlier French incidents included manipulation of controllers causing systems to heat up to 50 degrees Celsius. Based on initial public reporting, the same methodology appears to be in play for this incident. It is unclear if the 50 degree mark is a system maximum for the impacted controllers, or represents continuous use of an arbitrary value in these attacks.
The tradecraft employed across both the French incident and the latest series of attacks relies heavily on accessible, insecure devices, including unpatched vulnerabilities and potentially default credentials. As such, these attacks are not especially sophisticated in the technical sense, although the scale and coordination across multiple victims is of interest.
Immediate Actions & Recommendations
- Immediately identify internet-accessible control systems and restrict access to these devices wherever possible.
- Apply system patches and change default credentials wherever possible on critical control system assets, and do so immediately for any devices that must be remotely accessed.
- Monitor remote authentication sessions for signs of abuse, such as uncommon geographies or timing, to identify potential incidents as they emerge.
- For governments, CERTs, and other authorities, review public and commercial internet scanning data to determine overall risk of exposed systems within relevant geographies. Engage in coordinated disclosure and assist in hardening systems where possible to reduce systemic risk.
2026 Mid-Year Cyber Threat Landscape Report
The first half of 2026 was defined by a widening gap between attack speed and defense speed — and AI is accelerating both sides. Dataminr’s 2026 Cyber Threat Landscape Mid-Year Report pulls from 4,500 threat actors tracked, 73,000 vulnerabilities detected, and over 2 million alerts processed per month to surface what actually mattered in H1 and what teams need to prepare for in H2.
Download Report
