European Retail Refrigeration OT Disruption — Sentinel Exposure and Access Hunts

Threat Overview

Reuters reported November 2 that attacks disrupted refrigeration equipment across multiple European retail locations, causing elevated temperatures and food loss. Some systems reportedly used Danfoss technology. No common vulnerability, actor attribution, attack method or validated IOC set has been established. The hunts below are general OT exposure/access investigations, not signatures for these incidents.

References

Reuters (November 2, 2026): https://www.reuters.com/business/retail-consumer/temperature-soars-swedish-grocery-store-freezers-one-store-blames-hackers-2026-11-02/

Impacted Systems

Retail refrigeration and building-management controllers, gateways and remote-access services. Vendor, product model, versions, fixed builds, ports and attacker prerequisites are not confirmed. Internet-reachable management interfaces are a general risk, not a confirmed entry point in these incidents.

Why this matters

Physical operational disruption demonstrates potential safety and business impact of exposed OT management services.

Exploitation Status

Disruptions reported; root cause, intrusion method and actor identity are unconfirmed.

What this hunt looks for

External sources accessing known OT subnets, new inbound source IPs, identity failures and broad remote-management exposure. Customer-specific OT subnets must be supplied before running subnet-based queries.

Required logs

CommonSecurityLog, SigninLogs; controller command telemetry not confirmed.

Inbound OT network access (configure subnets)

let OTSubnets=dynamic(["192.0.2.0/24"]); // REPLACE placeholder with customer-confirmed OT subnets; never run unchanged
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where ipv4_is_in_any_range(DestinationIP, OTSubnets)
| where not(ipv4_is_private(SourceIP))
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity

New OT source IPs (configure subnets)

let OTSubnets=dynamic(["192.0.2.0/24"]); // REPLACE with confirmed OT subnets
let baseline=CommonSecurityLog | where TimeGenerated between (ago(30d)..ago(2d)) | where ipv4_is_in_any_range(DestinationIP,OTSubnets) | summarize by SourceIP;
CommonSecurityLog
| where TimeGenerated > ago(2d) and ipv4_is_in_any_range(DestinationIP,OTSubnets)
| where not(ipv4_is_private(SourceIP))
| join kind=leftanti baseline on SourceIP
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction

Authentication failure bursts

SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType != "0"
| summarize Failures=count(), IPs=make_set(IPAddress,10) by UserPrincipalName, bin(TimeGenerated,15m)
| where Failures >= 10

Exposed remote management ports

CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationPort in (22,23,80,443,3389,5900,8080,8443)
| where not(ipv4_is_private(SourceIP))
| where DeviceAction has_any ("allow","accept","permit")
| summarize Connections=count(), Sources=dcount(SourceIP) by DestinationIP, DestinationPort, DeviceName
| where Sources >= 3

Detection Notes

These are generic OT exposure hunts; no CVE-specific or actor-specific detection is possible from the reporting. Placeholder OT subnet must be replaced before execution. Authentication failures and remote management traffic are not evidence of refrigeration sabotage. Without controller/SCADA telemetry, physical changes are invisible in Sentinel. No customer workspace was queried.