Experts dismiss hackers’ evidence for freezer attacks

Four security analysts say files published by pro-Russian hacker group NoName057(16) do not prove it accessed or changed settings in refrigeration systems targeted in attacks across Europe, SVT reports.

The day after the attacks, on November 3, the group posted two files of email addresses and passwords on the dark web. It presented them as evidence that it had carried out the attacks alongside hackers from Z-Pentest Alliance. But SVT found that the email addresses appeared in earlier data leaks, meaning the lists cannot establish that a new breach took place.

“The material itself does not prove that they actually changed any settings in the refrigeration systems,” Sai Molige, head of threat analysis at cybersecurity company Forescout, told SVT. Sekoia analyst Maxime Arquillière said stronger evidence would include data available only inside the affected systems, such as internal configurations, store IDs or time-stamped screenshots.

Credentials may not have been needed

The hackers’ post did not explain how the published login details were used. Arquillière said some Danfoss devices can be accessed without credentials.

Software from Danish company Danfoss controls the stores’ refrigeration units and has known security flaws that have allowed hackers to bypass logins. Danfoss told Dutch broadcaster NOS that the attacked systems were not on a secure network and used default passwords. The company had reportedly urged its Dutch customers in October to disconnect their systems from the internet and reconnect them through a secure network.

In a Telegram post shared by the group, the method was described as involving “no malware, no ransomware, no ransom demands” and as simply using functions built into the equipment by its manufacturer.

Danfoss declined to comment on the hackers’ claims. In a statement to Danish broadcaster DR, it said there were no signs of a successful attack on its internal IT infrastructure or a data breach. The company said it could not confirm the specific information published by the groups and would not speculate about who was responsible.

SVT’s review of the files

One file, said to contain details belonging to Danfoss employees, lists 171 unique email addresses linked to the company’s web domain, along with passwords. SVT found that 168 of the addresses appeared in older leaks. Many were included in “stealer logs” released in February 2025, which contain credentials collected from infected devices using malicious software.

The second file lists 1,161 unique email addresses and passwords said to belong to Danfoss customers. Nine addresses were linked to Swedish .se domains, and all nine appeared in older leaks. SVT’s random checks of other addresses in the file also found them in earlier leaks.

NoName057(16) is a pro-Russian cybercriminal group known for distributed denial-of-service attacks against targets in Europe. US authorities and independent investigations say the group is partly led by managers of a Russian state agency established to monitor young Russians’ internet activity.

Z-Pentest Alliance targets industrial control systems and critical infrastructure with intrusions and influence operations. US indictments have linked it to Cyber Army of Russia Reborn, which was founded and directed by Russia’s military intelligence service, the GRU. Z-Pentest has said in an interview that it coordinates attacks with NoName057(16) out of political solidarity and shared aims, including weakening the West, stopping NATO and targeting countries that help Ukraine.