More than 5,000 refrigeration devices made by the manufacturers French authorities flagged last month were still reachable from the open internet on November 5 and 6, according to new measurements from Palo Alto Networks' Unit 42. The finding, from researchers Matt Brady and Jared Valentine, lands days after a second wave of attacks forced supermarkets across Europe to throw out spoiled food.
Unit 42 is careful about what the number means. An exposed device is not necessarily running vulnerable software, and the count says nothing about which units were actually hit. What it does show is how much of the equipment behind the campaign is still sitting in plain view, weeks after the first attacks and with the holiday shopping season approaching.
Two waves, hundreds of stores, one unknown door
In the original report, Unit 42 summarises the campaign so far. The first wave ran overnight on October 11 to 12 and primarily hit around 700 supermarkets in France. A second wave in early November spread to at least 10 more European countries and more than 100 retail locations. The attackers gained access to refrigeration controllers and set them to defrost mode, and Unit 42 cites reporting that temperatures were pushed as high as 50°C (122°F), in some cases causing fires.
French authorities have since disclosed that refrigeration systems at medical facilities were also affected, though Unit 42 says there is no evidence so far that blood products were spoiled. The initial access vector is still unconfirmed. Suspicion centres on vulnerable software versions or manufacturer default credentials, but neither has been established, a gap SentinelLABS also stressed in its assessment of the November wave.
France's exposure is shrinking fast
Because France took the brunt of the first wave, Unit 42 tracked how many exposed devices from the named manufacturers it could see there since October 1, using its Cortex Xpanse internet scanning. The counts fell across three successive windows:
- October 1 to 15: 1,853 devices
- October 16 to 31: 558 devices
- November 1 to 6: 316 devices
The windows are not the same length, so the figures are not a precise rate, but Unit 42 describes the decline as significant. It follows CERT-FR's October alert, which named the affected equipment makers, although Unit 42 does not attribute the drop to any specific cause. France remains the country where the attacks have done the most damage.
Hacktivists claim it, nobody has confirmed it
On November 3, the pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility for the attacks in Telegram posts. Unit 42 stresses that those claims remain unverified, so the question of who is behind the campaign is still open.
Take controllers off the internet and change default passwords
CISA released an advisory on November 5 warning of potential exploitation through authentication bypass, arbitrary code injection and weak configurations. That joint US guidance asks operators to remove public internet exposure from controller panels, put any remote access they truly need behind an updated firewall, separate OT devices from business networks, and replace default passwords. Unit 42's own recommendations focus on finding exposed devices and blocking exploit attempts at the network layer.
The French numbers show that exposure can be cut quickly once operators know where to look. The 5,000 devices still visible across Europe show how much of that work is left, at the time of year when, as Unit 42 notes, retailers most need full shelves.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.