Pro-Russian groups claim supermarket freezer attacks, but attribution remains open

The BBC reported that NoName057(16) and Z-Pentest Alliance said on Telegram that they had carried out the attacks together. The broadcaster said the posts and channels have since been deleted. No formal attribution has been made, and one cyber-security commentator cited by the BBC suggested the groups might be claiming someone else’s actions.

The disruption itself is well documented. On 2 November, technology publication BleepingComputer reported that more than 115 stores in six European countries had been affected. Some refrigeration units were shut down or put into defrost mode, and food was lost. Sweden’s Coop told the publication that seven of its more than 800 stores had been affected, with one system beginning to generate heat.

In an assessment published on 3 November, before the BBC reported the groups’ claim, security researchers at SentinelLABS described pro-Russian groups as a credible line of investigation. But they warned that copied techniques and opportunistic claims could make separate incidents look like a single campaign. Access records or verifiable details not already public could help investigators connect an incident to a particular operator, the researchers said.

An earlier wave affected hundreds of French supermarkets in October. France’s cyber-security agency assessed at the time that exposed administrative interfaces and weak passwords were involved. SentinelLABS said it was not yet known whether the same route had been used in the later incidents.