Russian Hacktivist Groups Claim Responsibility for European Supermarket Freezer Cyberattacks
Hackers targeted commercial refrigeration systems across Europe, causing temperature spikes and significant food spoilage.
1Coordinated Freezer Attacks
Russian hacktivist groups Noname057(16) and Z-Pentest Alliance claimed responsibility for recent cyberattacks on European supermarket freezers. These incidents caused internal temperatures to rise, leading to widespread food spoilage. While these groups bragged about their precision on Telegram, their posts were later deleted, leaving security researchers skeptical about the actual perpetrators.
2Honeypot Security Analysis
Cybersecurity firms including Previdian, Lupovis, and Sequoia deployed honeypots—digital decoys designed to lure attackers—to monitor the threat. These traps revealed that hackers were specifically scanning for vulnerable freezer software across Europe. Interestingly, these probes were geographically focused, as researchers observed no similar malicious activity targeting honeypots located in Africa or South America.
3Methodology and Vulnerabilities
The affected freezer systems suffered from poor protection, utilizing known attack methods easily accessible online. Attackers had to compile lists of public IP addresses to execute the strikes. Ryan Dewhurst of Previdian noted that the timing of the temperature increases, specifically occurring overnight, indicates a high level of planning and coordination.
4Potential Attribution Uncertain
While Russian groups are under suspicion, experts have not ruled out other actors, including Iranian hacktivists or even teenagers. Sequoia’s report highlights that Iranian-aligned actors have previously targeted similar industrial control systems in Israel and the United States. The lack of definitive evidence makes identifying the specific culprit a complex, ongoing forensic challenge.
5Historical Attack Patterns
The current wave of attacks mirrors previous incidents involving Danfoss controllers. In 2022, approximately 40 Israeli supermarkets experienced similar compromises. Additionally, in late August, freezers at at least six US military bases were forced into defrost mode. These recurring events suggest that internet-exposed industrial control systems remain a persistent and attractive target.
6Skepticism Regarding Claims
The claims made by Noname057(16) and Z-Pentest Alliance are being met with doubt by the cybersecurity community. Some analysts suggest these groups may be opportunistically claiming credit for attacks only after researchers publicly speculated about potential culprits. The deletion of their social media channels further complicates efforts to verify their involvement in the hacks.
7Industrial Control Risks
The ease with which these attackers exploited poorly secured freezer software highlights broader vulnerabilities in commercial infrastructure. By manipulating temperature settings, hackers can cause significant financial damage to retailers. Security experts warn that unless these industrial control systems are properly isolated from the public internet, they will remain susceptible to future, potentially larger, disruptions.
8Ongoing Investigation Status
Authorities across several European countries are actively investigating the breaches and issuing warnings to supermarket chains. While firms continue to analyze data from their digital traps, they emphasize that the level of coordination required points toward a sophisticated group. Investigators remain vigilant for further bragging or evidence that might confirm the attackers' identities.