Two pro-Russian hacking groups, NoName057(16) and Z-Pentest, have claimed responsibility for a series of cyberattacks targeting supermarket refrigeration systems across Europe, according to Italian public broadcaster Rai’s TG1. The groups released a video claiming they had remotely manipulated commercial cooling equipment, disrupting operations and causing significant food losses at affected retailers. The attacks have impacted supermarkets and other food businesses across multiple European countries, although investigators have not independently confirmed the groups’ involvement.

The claim was reported Wednesday, November 4, after a new wave of refrigeration system disruptions struck retailers across Europe earlier in the week. In the video, circulated through social media and Telegram, the groups identified equipment manufactured by Danfoss and the Dixell XWEB line of refrigeration management systems as targets. They claimed they had exploited existing system functions rather than deploying malicious software, allowing them to interfere with refrigeration controls remotely. The statements have not been independently verified, and authorities have not established whether the incidents in different countries were carried out by the same attackers.

The footage also contained a warning concerning other types of infrastructure, including water supply systems, power stations, industrial facilities and food storage sites. The groups claimed their activities had affected hundreds of locations across Europe and suggested that further operations could follow. However, the video provided no independently verified evidence establishing the full scale of the operation or confirming the groups’ broader claims. No additional attacks against the infrastructure mentioned in the warning have been established solely through the statement.

The latest incidents began during the early hours of Monday, November 2, when retailers in Belgium, Luxembourg, Sweden, Ireland, Estonia and other European countries reported abnormal refrigeration temperatures. Some systems were reportedly adjusted to 50 degrees Celsius, or 122 degrees Fahrenheit, while other installations were shut down or placed into defrost modes. The disruptions forced supermarket operators to remove chilled and frozen products from sale, discard spoiled inventory and temporarily restrict food availability at affected locations.

Retailers including ICA, Coop, Carrefour, Ahold Delhaize, Colruyt and Musgrave acknowledged refrigeration incidents at their stores. Cybersecurity publication BleepingComputer documented disruptions at more than 115 locations across several countries, while subsequent reporting identified additional affected businesses. In Sweden, ICA confirmed that 23 stores had equipment connected outside its centrally managed network affected by the attack, according to Reuters. The company said the incidents involved refrigeration systems that operated independently of its primary retail infrastructure.

The November incidents followed a similar cyberattack in France during October, when refrigeration management systems at hundreds of supermarkets were compromised. French authorities investigated unauthorized changes to temperature and defrost controls involving equipment from Danfoss, Copeland and Dixell. The earlier incidents caused substantial food losses and prompted renewed attention to the security of commercially operated refrigeration equipment connected to the internet. Investigators have not publicly established whether the October and November attacks were conducted by the same individuals or organizations.

Cybersecurity research published by Forescout on October 22 identified more than 20 claimed attacks against refrigeration systems since January 2026. The company’s researchers found that Z-Pentest Alliance and NoName057(16) were among the most active pro-Russian groups making such claims. The reported targets included supermarkets, wineries, fruit storage facilities and other agricultural businesses across several European countries. Although the findings provide context for the groups’ previous activities, they do not independently establish responsibility for the latest supermarket attacks.

Both organizations have previously been associated with cyber operations directed at European institutions and critical infrastructure. NoName057(16), active since 2022, has frequently conducted distributed denial-of-service attacks against government agencies and commercial organizations in countries supporting Ukraine. Z-Pentest, established in 2024, has concentrated more heavily on operational technology, including industrial control systems used in energy and water infrastructure. The European Union sanctioned Z-Pentest in July 2026, citing its involvement in significant cyberattacks, including an operation against a Danish water utility.

A December 2025 joint cybersecurity advisory issued by American, European and allied security agencies described Z-Pentest as an organization formed by members of NoName057(16) and Cyber Army of Russia Reborn, also known as CARR. The advisory assessed that Russia’s military intelligence service, the GRU, had likely supported CARR’s creation and funded some of its operations through at least September 2024. However, the same assessment characterized Z-Pentest as having formed separately from GRU involvement. These historical connections do not establish that Russian military intelligence directed or participated in the November 2026 supermarket attacks.

The incidents have also exposed weaknesses in remotely managed commercial equipment. Forescout identified more than 12,900 observations of internet-exposed refrigeration management services associated with approximately 6,000 distinct public IP addresses across 99 countries and territories. Such systems allow authorized technicians to monitor temperatures and adjust operating conditions remotely, but poorly secured connections can also expose those functions to unauthorized access. Researchers warned that attackers can potentially cause physical disruption by exploiting existing administrative capabilities without deploying conventional malware.

European retailers have begun implementing additional protective measures as investigations continue. Reuters reported Tuesday that Swedish supermarket operator Coop was moving toward updated network equipment and disconnecting affected refrigeration systems from direct internet access. Danfoss also advised customers against leaving refrigeration management equipment directly accessible from the public internet. Cybersecurity agencies have similarly recommended stronger authentication, updated software and restrictions on remote access to industrial control systems.

The latest claim of responsibility provides a possible explanation for the widespread incidents but leaves several questions unresolved. Authorities have not confirmed the identity of the attackers, the precise method used to gain access or whether the incidents across different countries were coordinated. The scope of the damage and any direct connection to Russian state authorities also remain unconfirmed as affected retailers and cybersecurity investigators continue examining the disruptions.