A wave of co-ordinated cyberattacks targeting refrigeration systems across Europe has ruined millions of euros worth of perishable goods, exposing security vulnerabilities in connected commercial infrastructure.

From weeks of covert reconnaissance to suspected and impacts on the UK food supply chain, here we look at exactly what happened and what it means for the future of connected infrastructure.

1. The attacks: How hackers targeted supermarket fridges

In early November, supermarkets and food retailers across at least nine European nations – alongside several blood banks in France – suffered a synchronised cyber-disruption. Hackers gained remote access to internet-connected Danfoss AK-SM refrigeration system managers and maliciously overrode temperature settings, forcing units into defrost mode and cranking temperatures as high as 50°C (121°F) to 55°C (131°F). The sudden warmth spoiled massive quantities of frozen goods and forced grocery stores to throw out ruined stock.

2. Weeks of covert reconnaissance

According to cybersecurity firm Lupovis, the attacks were preceded by a heavy, targeted wave of scanning and reconnaissance. Between October 20 and 30, Lupovis recorded over 276 probing attempts from 91 distinct threat actors, with activity peaking sharply on October 26 before halting right before the assault. Hackers tested default administrative credentials, such as the standard factory-set username “Supervisor” and password “12345”, and searched for known vulnerabilities on Danfoss controllers exposed directly to the open internet without virtual private networks (VPNs).

3. Impact on the UK food supply chain

The disruption quickly crossed the Channel, affecting businesses within the UK’s food supply chain. The National Cyber Security Centre (NCSC) confirmed it was aware of “a couple of instances where vulnerable technology had been exploited in the UK,” with CEO Dr. Richard Horne noting that teams worked through the night to alert vulnerable organizations. Meanwhile, the British Association of Independent Meat Suppliers (AIMS) reported that several of its more than 300 members unexpectedly became “collateral damage” in the sweeping attacks.

4. Who was behind it? Kremlin denials vs. hacktivist claims

The identity of the perpetrators behind the refrigerator cyberattacks remains heavily debated amid conflicting claims and official denials. Initially, pro-Russian hacktivist groups NoName057(16) and Z-Pentest Alliance claimed joint responsibility for the disruptions via Telegram before subsequently deleting the posts, while cybersecurity firm Lupovis noted that “bulletproof hosting” infrastructure previously utilised by Russian actors was observed during the reconnaissance phase.

In response, the Kremlin strongly dismissed any suggestion of state involvement, with spokesman Dmitry Peskov characterising the accusations as absurd claims backed by absolutely no reasoning or evidence.

Meanwhile, independent cybersecurity researchers remain sceptical too, warning that groups like NoName057(16) may simply be attempting to capitalise on high-profile incidents for publicity. Other analysts emphasise that because the hackers relied on basic default passwords and unpatched login pages rather than sophisticated malware, the responsible party could be a group of unskilled individuals.

5. Why these systems were vulnerable

Experts point out that the retail sector has historically prioritised securing obvious digital assets like payment systems and customer databases while treating connected physical equipment as an afterthought. Many building controllers and refrigeration units are left exposed directly to the open internet instead of being safely isolated behind VPNs. Furthermore, organisations frequently leave default manufacturer passwords active and delegate physical equipment management to facilities teams rather than corporate cybersecurity departments, creating an overlooked attack surface.

6. Could other connected infrastructure be next?

Security experts warn that supermarket freezers are merely the most visible example of a much wider class of vulnerable connected devices. The same small used to adjust temperatures also govern building access-control readers, surveillance cameras, fire alarms, interior lighting and across offices, hospitals and data centres. In these environments, a similar compromise could unlock doors, disable cameras, or silence alarms without any spoiled stock to provide an immediate warning.

7. The threat of AI-accelerated attacks going forward

As organisations scramble to audit their physical security postures, experts caution that the threat landscape is evolving rapidly. Artificial intelligence tools are drastically collapsing the timeframe required to discover device vulnerabilities and turn them into functional cyberattacks.

Going forward, security specialists argue that organisations cannot rely solely on periodic software patches or perimeter defences; connected physical devices must be engineered with runtime self-defence capabilities to autonomously block anomalous behaviour, regardless of whether a patch has been issued.

For latest tech stories go to TechDigest.tv