Two Russian hacktivist groups, Noname057(16) and Z-Pentest Alliance, have claimed responsibility for a wave of cyberattacks that disrupted freezer systems in European supermarkets. The groups posted on the messaging platform Telegram, asserting they had demonstrated a high level of skill and precision.
However, their claims are being met with skepticism, particularly after their posts and channels were subsequently deleted. Cybersecurity researchers from multiple firms are analyzing evidence gathered from digital decoy systems, known as 'honeypots,' to identify the true culprits. While Russian groups are not being ruled out, experts suggest that Iranian hacktivists, nation-state actors, or even prankish teenagers could be responsible.
Specialized cybersecurity firms have deployed fake freezer software traps to monitor and understand the methods employed by attackers. Honeypots are deliberately set up as vulnerable targets to lure and trap hackers, allowing experts to study their techniques without risking real systems. Initial analysis of the cyberattacks indicates that the second wave, which affected several European countries, was highly targeted. The simultaneous disruption of numerous freezer units suggests significant planning and coordination.
Security experts noted that the entry point for the attacks was relatively easy to exploit due to poorly protected systems and publicly available attack methods. However, the attackers would have needed to gather information on the devices' public IP addresses to create a target list and then meticulously plan the execution. The timing of the attacks, reportedly occurring overnight to maximize damage, further supports the notion of a planned and coordinated operation.
One cybersecurity firm, Lupovis, observed scanning activity on its European honeypots approximately ten days before the second wave of attacks, with no activity noted on honeypots in other regions like Africa or South America, or even in Ukraine. Another firm, Sequoia, also detected scanning activity prior to the second wave, though it acknowledged this could have been automated and not malicious. Sequoia's report suggested that the nature of the attack aligned with activities of Russian hacktivists or the Russian government, often accused of hybrid warfare cyber-attacks. However, Sequoia's research also pointed to Iranian state-sponsored hackers, citing their history of targeting industrial control systems and previous incidents involving similar equipment in Israel and the US.
In 2022, approximately 40 Israeli supermarkets using Danfoss controllers were compromised. Separately, in late August, freezers at several US military bases were forced into defrost mode, mirroring the incidents in France. The controller models in the US incidents remain unconfirmed.
The deleted posts from NoName and Z-Pentest Alliance claimed to have targeted the freezer software maker Danfoss since the start of 2026. However, a cybersecurity content creator expressed doubt about their claims, suggesting they might be seeking credit after analysts posted their own findings. Authorities across several countries are actively investigating the hacks and have warned supermarkets of potential future attacks. As of now, no formal attribution has been made, and experts continue to analyze the evidence, leaving the door open to various possibilities, including sophisticated teenage pranksters if the coordination was sufficiently advanced.