Back to article list

Pro-Russian hacker groups take responsibility for extensive hacking of refrigerators and refrigerated counters.

DR-Inland in Denmark

Thursday, November 05, 2026 • 9:25 AM UTC - in Denmark

DR Verificerer ( https://www.dr.dk/verificerer )

DR Verificerer has gained access to a Telegram channel where the groups claim they also hacked Danfoss thermostats.

Supermarkets like the Swedish chain ICA had to throw away several kilos of food when refrigerators and cooling counters were hacked and reached temperatures that were far too high. (Photo: © Johan Nilsson, TT/Ritzau Scanpix) 8 min. ago Updated Just now

Pro-Russian hacker groups claim to be behind Monday's extensive hacker attack on refrigerators and cooling counters in Europe - including thermostats from Danfoss.

DR Verificerer has gained access to a group on Telegram that claims to be the official channel of the pro-Russian hacker group NoName057(16).

Here, a video called 'Operation Chronicle: Danfoss' has been published, in which NoName057(16) says it is behind the refrigerator hack - allegedly in collaboration with another pro-Russian group, Z-Pentest.

In the video, they say, among other things, that they have "dealt a crushing blow to Danfoss and Dixell XWEB equipment,

- We didn't even need malware for it. We simply exploited the systems' built-in functions, they say in the video, adding that one "should keep an eye on their actions on the global stage".

Linked to attack on waterworks in Køge

Both hacker groups are old acquaintances of the Danish authorities. Z-Pentest has previously been linked by the EU to the hacking of the waterworks near Køge. ( https://www.dr.dk/nyheder/politik/cyberangreb-mod-vandvaerk-ved-koege-udloeser-eu-sanktioner-mod-42-aarig-russisk-kvinde-og )

On a closed network, DR Verificerer has found 500 email addresses that are allegedly supposed to belong to real Danfoss employees. Several were duplicates, but it amounts to 167 email addresses and passwords.

We have asked Danfoss if they can confirm the email addresses are genuine. They write the following to DR:

- We are aware of the hacker groups' claims. There are no indications of a successful attack on Danfoss' internal IT infrastructure or a breach of data security.

Updating...

Facebook ( https://www.facebook.com/share.php?u=undefined )

Warning: This article was translated by a Large Language Model, in case of doubt, you can always visit the original source.