Two pro-Russian hacking groups have claimed responsibility for cyberattacks that disrupted refrigeration systems at supermarkets across Europe, causing substantial food losses. However, cybersecurity researchers have questioned the claims, and no independent evidence has established who carried out the attacks.
The groups, NoName057(16) and Z-Pentest Alliance, reportedly announced their involvement through Telegram posts following a wave of incidents on November 2, 2026. Both channels were subsequently deleted, making it difficult to verify the statements or examine the evidence presented.
NoName057(16) claimed to possess a database containing credentials belonging to employees and customers of Danish refrigeration technology manufacturer Danfoss. The group said it had released a sample of more than 2,500 records containing usernames and passwords. The authenticity of the alleged database and its connection to the refrigeration attacks remain unconfirmed.
Z-Pentest Alliance also claimed involvement, arguing that the incidents exposed longstanding security weaknesses in industrial equipment. The group has previously been associated with attacks targeting internet-connected operational technology, including systems used in food production and storage.
Threat intelligence researcher CyberKnow shared the groups’ statements but questioned whether they had actually conducted the intrusions or were attempting to take credit after the incidents attracted international attention.
The attacks affected retailers in at least eight European countries, including Belgium, Sweden, Ireland, Luxembourg, the Netherlands, Estonia, Denmark, and Finland. In some locations, attackers reportedly changed refrigeration settings to temperatures as high as 50°C (122°F), while other systems were switched into defrost mode.
Several supermarket chains, including Carrefour, ICA, Coop, and Ahold Delhaize, confirmed disruptions. Stores were forced to remove refrigerated and frozen products, with some businesses reporting significant financial losses.
The incidents followed similar attacks against hundreds of French supermarkets in October. Those earlier intrusions also involved remotely controlled refrigeration equipment, raising concerns about the security of systems connected directly to the internet.
Research by cybersecurity company Forescout identified nearly 13,000 exposed refrigeration-related services across 99 countries. Many were running outdated software, including Danfoss controllers affected by previously disclosed vulnerabilities.
Researchers have also documented earlier claims by Russia-linked hacktivists involving refrigeration equipment at supermarkets, wineries, agricultural facilities, and food-processing businesses. These incidents demonstrate the groups’ interest in such systems but do not establish their responsibility for the latest attacks.
European retailers have begun reviewing exposed equipment, installing security updates, and disconnecting vulnerable refrigeration controllers from public networks. Sweden’s cybersecurity authorities and other national agencies are investigating the incidents.
Neither NoName057(16) nor Z-Pentest Alliance has provided independently verified evidence linking its members to the November attacks. The identity of the perpetrators and whether the incidents formed part of a coordinated operation remain unresolved.