Experts Question Hacker Claims Regarding European Freezer Attacks
Pro-Russian group NoName057(16) fails to provide credible evidence for recent refrigeration system disruptions.
1Dubious Evidence Claims
The pro-Russian hacking group NoName057(16) claimed responsibility for recent attacks on European refrigeration units. To support their assertion, they published two files on the dark web containing email addresses and passwords. However, security analysts argue these files fail to prove any direct involvement in the specific system disruptions reported.
2Recycled Data Findings
An investigation by SVT revealed that the leaked data is not new. Out of 171 unique email addresses linked to Danfoss, 168 were found in previous data breaches, some dating back to February 2025. These 'stealer logs' consist of credentials harvested from infected devices, rendering them useless as proof of a fresh intrusion.
3Lack of System Access
Security experts emphasize that the published material lacks internal system data. Genuine proof would require specific evidence such as internal configurations, unique store IDs, or time-stamped screenshots from the victims' systems. Without such proprietary data, the hackers' claims remain unsubstantiated and lack the necessary technical markers to confirm their actual involvement.
4Vulnerabilities in Danfoss Systems
The attacks targeted refrigeration systems controlled by software from the Danish company Danfoss. These systems were reportedly connected to insecure networks and utilized default passwords. Danfoss had previously advised Dutch customers in October to disconnect their systems from the internet and reconnect them through secure, private networks to mitigate these risks.
5Authentication Not Required
Analysts note that attackers may not even need login credentials to compromise these specific units. Certain Danfoss devices are accessible without any authentication due to known security flaws in the manufacturer's software. This technical reality further undermines the hackers' attempt to frame the stolen email lists as the primary method used.
6Manufacturer Response
Danfoss stated there are no signs of a successful attack against their internal IT infrastructure or a breach of their data security. The company cannot confirm the specific information published by the hacking groups and has declined to speculate on the identity of the perpetrators behind the recent refrigeration system incidents.
7Methodology of Sabotage
The hackers described their method as the 'correct operation' of functions originally built into the equipment by the manufacturer. They claimed no malicious code or ransomware was deployed during the process. This suggests the attackers exploited existing, unpatched features rather than using traditional malware to force the systems into abnormal states.
8Broader Security Implications
This incident highlights the growing vulnerability of industrial control systems connected to the public internet. As attackers increasingly claim credit for infrastructure disruptions, the reliance on outdated credentials and insecure configurations poses a significant risk. Organizations must prioritize network isolation and robust authentication to prevent such unauthorized access to critical equipment.
Original article: SVT – Inrikes — Experts Question Hacker Claims Regarding European Freezer Attacks