Russian hacktivists say they were behind freezer hacks, but speculation remains

Two Russian hacktivist groups, Noname057(16) and Z-Pentest Alliance, have claimed responsibility for a series of freezer hacks affecting European supermarkets. However, their claims are met with skepticism as their social media channels have been deleted. Cyber-security researchers are investigating the hacks using honeypots, which are digital decoys set up to lure and trap hackers. These traps help researchers study the attackers' methods without risking real systems.

Experts suggest that the hacks could be the work of Iranian hacktivists, nation-state hackers, or even teenagers pulling a prank. The simultaneous targeting of multiple freezer software products suggests planning and coordination. The hackers had to gather information on the devices' public IP addresses to create a target list and plan their attack. The timing of the attacks, which occurred overnight for maximum damage, further indicates a well-coordinated effort.

Cyber-security firms like Previdian, Lupovis, and Sequoia have all deployed honeypots to monitor the hackers. Lupovis noticed scanning activity 10 days before the second wave of attacks, but none of their honeypots in Africa or South America were targeted. French firm Sequoia also detected scanning activity prior to the attacks, attributing the nature of the attack to Russian hacktivists or the Russian government, which is accused of carrying out hybrid warfare cyber-attacks across Europe. However, Sequoia's research also points to Iranian regime hackers or hacktivists.

According to multiple reports, Russian hacktivist groups may have targeted Danfoss freezer software since the start of 2026. A cyber-security content creator shared the hacktivist's claims on X, but expressed skepticism, suggesting that the activity could be falsely attributed to them. Authorities in several countries are actively investigating the hacks and warning supermarkets about potential future attacks.