Two Russian hacktivist groups have asserted responsibility for a series of cyber-attacks that disrupted freezer systems in supermarkets across Europe, but their claims are being met with doubt as investigations continue.
The groups, Noname057(16) and Z-Pentest Alliance, announced on Telegram that they had collaborated on the operation, boasting of having "once again demonstrated a high level of skill and precision." However, their posts and channels have since been removed, and cybersecurity researchers are questioning the veracity of their statements.
Honeypots Deployed to Trace Attackers
Experts from multiple cybersecurity firms are analyzing data from digital decoys, known as honeypots, to identify the perpetrators behind the attacks. These traps are designed to mimic vulnerable systems and attract hackers, allowing researchers to study their methods safely.
Three separate firms have set up fake freezer software traps to monitor hacking attempts. According to Ryan Dewhurst of the Spanish cybersecurity company Previdian, the second wave of attacks, which affected several European countries, was highly targeted. "The fact that all these fridge freezers were hit simultaneously suggests planning and coordination," he said.
The attackers exploited poorly protected freezer software with known vulnerabilities, but they still needed to gather public IP addresses of the devices, create a target list, and plan the timing of the attacks. Dewhurst noted that the temperature increases appeared to have been executed overnight to cause maximum damage, further indicating a coordinated effort.
Honeypot Activity Suggests Premeditation
Lupovis, a cybersecurity firm based in Strathclyde, deployed honeypots that appeared to be located worldwide and observed scanning activity 10 days before the second wave of attacks. Intriguingly, the team only saw hackers probing their fake freezer sites in Europe. "We saw none of our honeypots in places like Africa or South America targeted at all," said Dr. Xavier Bellekens, founder of Lupovis.
A third firm, French cyber-defence company Sequoia, also detected scanning activity prior to the second wave but noted it could have been automated scanning without malicious intent. In a report to customers, Sequoia suggested the attack's nature aligned with Russian hacktivists or the Russian government, which has been accused of conducting hybrid warfare cyber-attacks across Europe. However, the report also pointed to Iranian regime hackers or hacktivists, citing a history of targeting internet-exposed industrial control systems and previous incidents involving the same equipment in Israel and the US.
Claims Met with Skepticism
In a now-deleted post, Noname and Z-Pentest Alliance claimed to have targeted Danish company Danfoss, a manufacturer of freezer software, since the start of 2026. But a cybersecurity content creator who shared the claims on X expressed doubt, saying they were "not convinced it was them" and suggested the groups might be opportunistically claiming credit after analysts speculated about their involvement.
Authorities in several countries are actively investigating the hacks and warning supermarkets about potential future attacks. None of the three cybersecurity firms have ruled out the possibility that a teenager could be responsible, but they all agree that the level of planning required points to a well-coordinated group. If that is the case, experts expect online bragging to surface soon.
The incidents have raised concerns about the vulnerability of other technology. In 2022, about 40 Israeli supermarkets running Danfoss controllers were compromised, and in late August, freezers at six US military bases were forced into defrost mode. Investigations into those incidents are ongoing.
