- Unit 42 summarises public reports that refrigeration controllers at supermarkets in France and other European countries were changed, and stores threw out spoiled food.
- How the attackers got in is unconfirmed. Unit 42 counted over 5,000 internet-exposed devices from vendors in a CERT-FR advisory, but says that does not mean they are vulnerable.
- Ask your facilities and retail teams who owns building controllers, and whether any answer on a public internet address.
Whatever the route, a cooling setting can spoil food
Whatever the entry route turns out to be, an attacker who controls a refrigeration controller can turn a changed setting into physical loss. These attacks hit goods on shelves rather than data.
That is the author's reading of what Palo Alto Networks' Unit 42 describes. Its overview is a summary of public reporting. Unit 42 says the initial access route is unconfirmed, and this story does not assume one.
What Unit 42 reports
Unit 42 says it has tracked the activity since at least October 2026. Its overview rests on public reporting, not on its own incident response work.
Unknown actors got into refrigeration controllers and switched them to a defrost setting. Hundreds of supermarkets across the region threw out spoiled food.
The first wave came overnight on Oct. 11 and 12. Unit 42 says it mostly targeted about 700 supermarkets in France.
A second wave came overnight on Nov. 1 and 2. It reached at least ten other European countries and affected more than 100 retail locations. Unit 42's text gives the figure as 100–115.
French authorities also said refrigeration at medical facilities was affected. Unit 42 says nothing suggests blood products spoiled.
Citing multiple sources, Unit 42 says the attackers pushed the heat in some targeted units up to 50°C (122°F). In some cases there were fires.
How a controller turns a setting into spoilage
A refrigeration controller is the small computer that decides when a cooling unit runs. Its settings can be changed by staff or software, sometimes from a distance.
Defrost is a normal setting. It warms the unit to melt ice. Left on for hours, it stops the unit chilling and lets stock warm. Done across many stores, it can spoil stock in each of them.
That explanation is general background. Unit 42 does not describe the devices or explain how the heat led to fires. It refers only to manufacturers listed in a CERT-FR advisory.
"Exposed to the internet" means a device answers on a public address, so anyone can try to reach it. Exposure is not compromise. Unit 42's count measures exposure only.
What is known and unknown about entry
Unit 42 says there is widespread speculation that devices ran vulnerable software, used default manufacturer credentials, or both. A default credential is a factory password nobody changed. This is speculation, and Unit 42 does not confirm it.
On Nov. 5, CISA published an advisory naming three possible weak points. They are bypassing the login, injecting code, and poor configuration. Injected code lets an intruder run its own instructions on the device.
Two pro-Russian groups, NoName057(16) and Z-Pentest, said on Telegram on Nov. 3 that they were responsible. Unit 42 says those claims are unverified.
Reading the exposure count
On Nov. 5 and 6, Unit 42 used its Cortex Xpanse tool to count internet-exposed devices. It looked at makers named in the CERT-FR advisory. It found more than 5,000.
Unit 42 warns the figure does not show those devices run software an attacker could exploit.
Unit 42 also tracked exposed devices in France from Oct. 1. It reports a significant decline across three periods. The summary gives no reason, so none should be assumed.
A possible ownership gap
This section is the author's hypothesis, not a finding. In many organisations, store refrigeration may sit with facilities teams. That could place it outside the security team's asset list.
If so, nobody may be checking whether a controller answers on a public address. Neither Unit 42 nor WebPulse data says how common this is.
Unit 42 stresses the timing. Retailers need full stock as holiday spending rises. Unit 42 also sells related products, including Cortex Xpanse. Weigh its product guidance with that in mind.
Questions to put to your teams
First, who owns refrigeration and other building controllers? Are they on the security team's asset list?
Second, can any of these controllers be reached from the internet? If so, is that needed?
Third, have factory default passwords been changed on every device? Have the vendors in the CERT-FR advisory been checked against your equipment?
Fourth, if a store's cooling is changed overnight, who is alerted, and how fast?
The cold chain depends on software that some organizations may not be tracking. Finding it is the first job.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Palo Alto Networks Unit 42.
