CERT Polska confirmed cyberattacks on internet‑connected refrigeration systems at a Polish grocery store and food distributor; staff saved products, while authorities warn about dozens of exposed cooling devices amid similar attacks across multiple EU states.

Cyber & Information WarfareCyber AttacksAttacks on critical infrastructure (energy, transport, hospitals)

Aggressor

Summary

According to UA.News citing RMF24 and CERT Polska, cyberattacks in Poland targeted the internet‑connected refrigeration equipment of a small grocery store and a food distributor. The incidents occurred the previous day (relative to 3 November 2026) and were confirmed by CERT Polska. Store and distributor employees detected that refrigeration temperatures were abnormally rising, removed the food products in time, and therefore avoided material losses. Following a similar earlier attack on refrigeration systems in France, the Polish research institute NASK scanned for refrigeration devices in Poland that were reachable from the public internet, identifying 140 such devices; the operators of those facilities were informed of the need to disconnect the equipment from the internet. CERT Polska head Marcin Dudek stated that about 70 devices currently accessible from the internet are responsible for cooling systems at comparable facilities and urged all relevant entities to take these warnings seriously to prevent further attacks. The article notes that in recent days analogous cyberattacks against supermarket refrigeration systems have been recorded in Belgium, Sweden, Luxembourg, Estonia, the Netherlands, and Ireland, and in several of those cases attackers raised refrigerator temperatures enough to spoil food.

Classification

Confidence: High

The primary subject is malicious cyber activity against commercial cooling systems, explicitly described as cyberattacks that manipulate equipment temperatures and have already caused food spoilage in multiple EU states. This constitutes hostile cyber operations against civilian infrastructure, fitting the Cyber & Information Warfare / Cyber Attacks category rather than routine technical malfunction or defensive preparation.

Source URL

https://ua.news/en/world/u-polshchi-atakuvali-kholodilne-obladnannia-magazinu-i-distribiutora-rmf24

Open source

Provenance

Publisher: extension
Submitted: Nov 3, 2026, 14:21 UTC
Last updated: Nov 4, 2026, 02:48 UTC
Event time: Nov 2, 2026, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "754e0f32-95b6-4e98-be2d-a2314c586ca5",
  "url": "https://ua.news/en/world/u-polshchi-atakuvali-kholodilne-obladnannia-magazinu-i-distribiutora-rmf24",
  "source": "extension",
  "status": "processed",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
  "country": "Poland",
  "source_reliability": "F",
  "info_credibility": "6",
  "tags": [
    "Poland",
    "CERT Polska",
    "NASK",
    "RMF24",
    "cyberattacks",
    "OT security",
    "refrigeration systems",
    "critical infrastructure",
    "food supply",
    "Polish grocery store",
    "food distributor",
    "France",
    "Belgium",
    "Sweden",
    "Luxembourg",
    "Estonia",
    "Netherlands",
    "Ireland",
    "EU cyber incidents",
    "industrial control systems",
    "internet‑exposed devices"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "According to UA.News citing RMF24 and CERT Polska, cyberattacks in Poland targeted the internet‑connected refrigeration equipment of a small grocery store and a food distributor. The incidents occurred the previous day (relative to 3 November 2026) and were confirmed by CERT Polska. Store and distributor employees detected that refrigeration temperatures were abnormally rising, removed the food products in time, and therefore avoided material losses. Following a similar earlier attack on refrigeration systems in France, the Polish research institute NASK scanned for refrigeration devices in Poland that were reachable from the public internet, identifying 140 such devices; the operators of those facilities were informed of the need to disconnect the equipment from the internet. CERT Polska head Marcin Dudek stated that about 70 devices currently accessible from the internet are responsible for cooling systems at comparable facilities and urged all relevant entities to take these warnings seriously to prevent further attacks. The article notes that in recent days analogous cyberattacks against supermarket refrigeration systems have been recorded in Belgium, Sweden, Luxembourg, Estonia, the Netherlands, and Ireland, and in several of those cases attackers raised refrigerator temperatures enough to spoil food.",
  "summary_short": "CERT Polska confirmed cyberattacks on internet‑connected refrigeration systems at a Polish grocery store and food distributor; staff saved products, while authorities warn about dozens of exposed cooling devices amid similar attacks across multiple EU states.",
  "summary_extended": null,
  "actor_primary": "CERT Polska",
  "target_primary": null,
  "location_text": "Poland",
  "location_region": null,
  "location_coordinates_lat": 51.919438,
  "location_coordinates_lon": 19.145136,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The primary subject is malicious cyber activity against commercial cooling systems, explicitly described as cyberattacks that manipulate equipment temperatures and have already caused food spoilage in multiple EU states. This constitutes hostile cyber operations against civilian infrastructure, fitting the Cyber & Information Warfare / Cyber Attacks category rather than routine technical malfunction or defensive preparation.",
  "event_time_utc": "2026-11-02T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-11-03T14:21:00.045Z",
  "updated_at": "2026-11-04T02:48:28.892Z",
  "reliability_band": "pattern",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "minor",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: Pattern fitSeverity: MinorAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Nov 2, 2026, 00:00 UTC

Event time confidence

pm24h

Location

Poland

Primary actor

CERT Polska

Country

Poland

Tags

Poland, CERT Polska, NASK, RMF24, cyberattacks, OT security, refrigeration systems, critical infrastructure, food supply, Polish grocery store, food distributor, France, Belgium, Sweden, Luxembourg, Estonia, Netherlands, Ireland, EU cyber incidents, industrial control systems, internet‑exposed devices

Loading signal...

{ "id": "754e0f32-95b6-4e98-be2d-a2314c586ca5", "url": "https://ua.news/en/world/u-polshchi-atakuvali-kholodilne-obladnannia-magazinu-i-distribiutora-rmf24", "source": "extension", "status": "processed", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)", "country": "Poland", "source_reliability": "F", "info_credibility": "6", "tags": [ "Poland", "CERT Polska", "NASK", "RMF24", "cyberattacks", "OT security", "refrigeration systems", "critical infrastructure", "food supply", "Polish grocery store", "food distributor", "France", "Belgium", "Sweden", "Luxembourg", "Estonia", "Netherlands", "Ireland", "EU cyber incidents", "industrial control systems", "internet‑exposed devices" ], "nodes": [], "countries": [], "where_text": "Cyberspace", "headline": null, "description": "According to UA.News citing RMF24 and CERT Polska, cyberattacks in Poland targeted the internet‑connected refrigeration equipment of a small grocery store and a food distributor. The incidents occurred the previous day (relative to 3 November 2026) and were confirmed by CERT Polska. Store and distributor employees detected that refrigeration temperatures were abnormally rising, removed the food products in time, and therefore avoided material losses. Following a similar earlier attack on refrigeration systems in France, the Polish research institute NASK scanned for refrigeration devices in Poland that were reachable from the public internet, identifying 140 such devices; the operators of those facilities were informed of the need to disconnect the equipment from the internet. CERT Polska head Marcin Dudek stated that about 70 devices currently accessible from the internet are responsible for cooling systems at comparable facilities and urged all relevant entities to take these warnings seriously to prevent further attacks. The article notes that in recent days analogous cyberattacks against supermarket refrigeration systems have been recorded in Belgium, Sweden, Luxembourg, Estonia, the Netherlands, and Ireland, and in several of those cases attackers raised refrigerator temperatures enough to spoil food.", "summary_short": "CERT Polska confirmed cyberattacks on internet‑connected refrigeration systems at a Polish grocery store and food distributor; staff saved products, while authorities warn about dozens of exposed cooling devices amid similar attacks across multiple EU states.", "summary_extended": null, "actor_primary": "CERT Polska", "target_primary": null, "location_text": "Poland", "location_region": null, "location_coordinates_lat": 51.919438, "location_coordinates_lon": 19.145136, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The primary subject is malicious cyber activity against commercial cooling systems, explicitly described as cyberattacks that manipulate equipment temperatures and have already caused food spoilage in multiple EU states. This constitutes hostile cyber operations against civilian infrastructure, fitting the Cyber & Information Warfare / Cyber Attacks category rather than routine technical malfunction or defensive preparation.", "event_time_utc": "2026-11-02T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-11-03T14:21:00.045Z", "updated_at": "2026-11-04T02:48:28.892Z", "reliability_band": "pattern", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "minor", "attribution_confidence_band": "high", "attribution_basis": "single_source" }