Default‑Credential Attacks Sabotage European Supermarket Refrigeration Systems, Spoiling Food Across 100+ Locations
What Happened — Unit 42 observed two coordinated campaigns (Oct 11‑12 2026 and Nov 1‑2 2026) that compromised internet‑exposed refrigeration controllers in more than 700 French supermarkets and later in ten additional European countries. Threat actors gained unauthorized access—most likely by exploiting manufacturer‑default usernames/passwords or unpatched firmware—and switched the units to a continuous defrost mode. Temperatures rose to 50 °C, causing thousands of perishable items to spoil and, in a few cases, triggering fires. The attacks also reached refrigeration units in several medical facilities, though no blood products were reported damaged. Over 5,000 similar devices were identified online during the investigation, underscoring a widespread exposure of operational‑technology (OT) assets.
Why It Matters for Trust & Control Assurance — The incident demonstrates how weak credential hygiene on OT devices can bypass traditional perimeter defenses, stressing the need for robust access‑control policies and continuous verification of device configurations.
Who Is Affected — Retail grocery chains, hospitality venues with on‑site food service, and medical facilities that rely on network‑connected refrigeration equipment.
Recommended Actions –
- Inventory all internet‑facing OT devices and map them to your asset register.
- Enforce unique, strong credentials for every controller; disable default accounts.
- Apply vendor‑provided firmware updates and segment OT networks from corporate IT.
- Deploy continuous monitoring to detect anomalous command changes on refrigeration units.
Source: Unit 42 Report
Technical Notes –
- Attack vector: Likely exploitation of default credentials; no specific CVE disclosed.
- Devices impacted: Commercial refrigeration controllers (often PLC‑style) from multiple manufacturers.
- Impact: Physical product loss, potential safety hazards, and operational downtime.
Source: Unit 42 Report