Cyber Attacks in 2026: From Supermarket Freezers to Banks, What Is Happening Worldwide

Posted on by
cyberattacks

Cyberattacks moved from screens to supermarket shelves this autumn: hackers remotely switched freezers to defrost across at least a dozen European countries, while ransomware, state-linked espionage and hacktivist disruption kept climbing everywhere else.

This guide pulls together the latest cyber attack news by region and sector, explains what each incident shows, and ends with practical steps any organisation can take. It reflects reporting available as of 11 November 2026.

What Are Cyber Attacks?

A cyber attack is any deliberate attempt to gain unauthorised access to, disrupt, damage or steal from computers, networks, connected devices or data. The people behind them range from criminal gangs chasing a ransom to government-linked units and politically motivated hacktivists.

Type of attack What it does 2026 example
Phishing and credential theft Tricks people into handing over logins The largest incident category reported to New Zealand’s NCSC in early 2026
Ransomware Locks or steals data and demands payment Japan recorded a record 123 ransomware cases in the first half of 2026
DDoS Floods a service so users cannot reach it Pro-Russian groups ran sustained campaigns against German banks
Website defacement Replaces a site’s content with the attacker’s message Malaysia’s Ministry of Health website, June 2026
Supply chain attack Compromises a vendor to reach its customers The Canvas learning platform breach, May 2026
Attacks on connected equipment Manipulates physical devices over the internet Supermarket freezers set to defrost across Europe

Cyber Attack Global: What the 2026 Numbers Show

Ransomware is the trend to watch. Check Point recorded 698 ransomware attacks worldwide in May 2026, up 48% on a year earlier, even though overall attacks per organisation (about 2,055 a week) rose only 2%. The United States accounted for 43% of reported ransomware victims.

Verizon’s 2026 breach analysis found ransomware in 48% of breaches, up from 44% the year before. Black Kite counted 146 active ransomware groups by June 2026, with 61 new groups appearing in twelve months. Kaspersky points to a growing shift toward extortion without encryption, where stolen data is the main lever.

On artificial intelligence, the UK’s NCSC says AI is more likely to speed up existing attack methods than to invent new ones. That matches the freezer attacks below, which relied on weaknesses that had been known for a long time.

Cyber Attack Europe: The Supermarket and Freezer Attacks

The biggest cyber attack story in Europe right now is the supermarket cyber attack on refrigeration. A first wave hit France on 11 to 12 October (covered in the next section). On 2 November a second wave reached supermarkets in at least 11 countries, including Belgium, Luxembourg, Sweden, Ireland, Italy, Estonia, Germany, Romania and the UK.

On that first day, fridges and freezers at more than 100 shops ran hot. One Swedish store reported freezers at 50°C (122°F). Musgrave said 13 SuperValu stores in Ireland were affected, and Delhaize reported dozens of shops in Belgium and Luxembourg. It was not only big chains: AP reported that a butcher in Athens had a refrigeration unit hacked as well.

Cyber attack freezers: how it worked

Investigators identified Danfoss refrigeration controllers (models AK-SM800 and AK-SC355) as the attack surface in France. Security firm Claroty had published research in August describing flaws in Danfoss systems that could let attackers bypass authentication, and Lupovis saw probing of such systems in the days before the November wave. The head of the UK’s NCSC said the French units were connected straight to the internet with default passwords, and a senior NCSC official stressed that this was not an AI-driven attack but the use of long-known weaknesses.

Beyond supermarkets

Hackers also targeted three sites of France’s public blood service, though the attack was stopped before blood stocks were compromised. On 5 November the US CISA, the FBI and other agencies warned of an ongoing threat to refrigeration and cold-chain monitoring systems, and the US Defense Department is investigating freezer incidents at military commissaries from August. The EU said the incidents were not isolated. No group has claimed the 2 November wave, and one Romanian official said he suspects no state actor was involved.

Cyber Attack France: The October Wave and the Iran Attribution

On the night of 11 October, attackers remotely put refrigeration controllers at roughly 700 French retailers into defrost mode. Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc stores were among those hit. French officials put the damage at tens of millions of euros in lost food and at least 15 fires.

On 9 November, France blamed Iran, naming Shahid Kaveh, an offensive cyber unit linked to the Islamic Revolutionary Guard Corps. The Paris prosecutor cited Farsi language and IP addresses pointing to devices in Iran, and requested international arrest warrants for the unit’s leader and two deputies. France summoned Iran’s ambassador and said it would impose sanctions. Tehran rejected the accusation as baseless.

France has faced other serious incidents in 2026. The tax authority confirmed in August that an attacker had been extracting data since late June using misused credentials, and on 13 July France publicly attributed a separate espionage campaign to Russia (see the Russia section below).

Cyber Attack UK: NCSC Warns of AI-Powered Ransomware by 2028

The UK’s National Cyber Security Centre published its Annual Review on 3 November. For 1 September 2025 to 31 August 2026 it logged 1,831 attack reports, supported 337 incidents and classed 80 as nationally significant. It judged it highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028, and said China is best positioned to use AI for such operations.

NCSC chief Richard Horne was careful to say AI has not invented new ways to attack, but will let long-tolerated weaknesses be found and exploited at scale. The NCSC estimates malicious cyber activity costs UK organisations about £14.7 billion a year, and the Jaguar Land Rover attack was cited as dragging on economic growth.

In the freezer wave, UK hackers tried to hit small meat-processing firms with minimal impact, according to the NCSC. In response the government is backing a £70 million National Exposure and Real-Time Vulnerability Centre and a planned AI-driven Cyber Shield. Earlier this year Horne said roughly three-quarters of more than 200 incidents affecting critical national infrastructure in the year to May were linked to hostile states.

Cyber Attack NZ: What the 2026 Threat Report Found

New Zealand’s NCSC released its Cyber Threat Report 2026 on 24 September, covering the year to June 2026. It recorded 369 incidents of potential national significance, 162 of them linked to criminal or financially motivated actors, an 18% rise, and said high-impact cybercrime was higher than in any of the previous five years. Reporting also noted four highly significant incidents in one year, as many as in the prior ten years combined.

The headline cases were:

  • Manage My Health: more than 99,000 patients’ records were stolen. The Ministry of Health’s reviews concluded the breach was largely preventable.
  • Canvas: a supply chain attack in May 2026 on the learning platform used by major tertiary providers.
  • ZenTech: a ransomware attack on the Dunedin clinical trial company, estimated around 18 August, with a group posting purported patient data.

Direct financial losses reached NZ$5.6 million in the first quarter of 2026, up 76%, and phishing and credential harvesting remained the biggest category with 437 reports. The NCSC also described a North Korean IT worker who secretly obtained remote work with a New Zealand business, which breaches sanctions.

New Zealand has not been named among the countries hit by the refrigeration attacks in the coverage reviewed. Even so, any business with internet-connected refrigeration or other control systems should check how they are secured.

Cyber Attack Iran: War-Linked Operations in 2026

US and Israeli strikes on Iran began on 28 February 2026, and cyber operations ran alongside them. On 11 March the Iran-linked group Handala was blamed for a destructive wiper attack on the US medical technology firm Stryker, which also disrupted operations in Ireland. Iran itself cut off from the global internet for 47 days before restoring limited access on 17 April, according to Palo Alto Networks’ Unit 42.

Security analysts reported that Iran-linked actors went on exploiting industrial controllers in US critical infrastructure, and that cyber activity did not slow during the April ceasefire. France’s attribution of the fridge attacks fits that pattern: it marks a move from stealing data and disrupting websites toward manipulating the physical equipment that keeps essential services running. Iran denies involvement.

Cyber Attack Russia: Attributions, Sabotage and the Ukraine War

On 13 July 2026, France, the EU and the UK publicly attributed malicious cyber activity against European states to the 16th Centre of Russia’s FSB, which oversees groups including Turla, and the EU imposed sanctions. The NCSC and 18 international partners also issued a joint advisory on the same FSB unit exploiting vulnerable routers to reach critical infrastructure networks.

Poland’s power grid was hit on 29 December 2025 in an attack on both IT and physical industrial devices, which CERT Polska attributed to a Russian-linked group known as Berserk Bear.

In the war itself, CybelAngel recorded 1,651 incidents against Ukrainian targets and 575 against Russian ones between January 2025 and January 2026, with DDoS making up around 84% of the Ukraine-facing activity. Russian state bodies have also been hit: Roskomnadzor and the defence ministry confirmed a large DDoS attack in February 2026.

Cyber Attack China: Espionage and the Race for AI Technology

Beijing denies the allegations below. On 26 August, the US Justice Department and FBI seized domains behind two platforms, QScan and QTRouter, which they said Chinese-linked actors used to hide the origin of attacks. A court affidavit described hacking from 2018 into 2026 that touched NASA, the Senate, the Federal Reserve and hospitals.

On 8 October, CISA and partners published an advisory on how Chinese government-linked actors combine automated reconnaissance with hands-on intrusion to steal data. CrowdStrike reported that China-nexus intrusion activity rose 38% in 2025, with an 85% jump in attacks on logistics organisations, and argues AI technology is now a prime espionage target. The UK’s NCSC likewise judges China best positioned to use AI against critical infrastructure.

Cyber Attack Japan: A Record Year and a Declared Emergency

On 9 October a senior ruling-party cybersecurity official described Japan as being in a state of emergency in cyberspace, after more than 20 major companies disclosed attacks within weeks. The National Police Agency logged a record 123 ransomware cases in the first half of 2026.

The victims include Times Car, JR East and SoftBank’s IDC Frontier cloud unit, hit by ransomware on 7 October. In September the Digital Agency disclosed a breach of a shared government network that may have exposed data on 246,000 people across 23 organisations, and Japan’s largest taxi operator, Nihon Kotsu, lost its dispatch systems in July.

Japan’s Active Cyber Defense law took effect on 1 October, letting police and the Self-Defense Forces act against malicious infrastructure and requiring critical infrastructure operators to report incidents. Some officials have suggested AI played a role, though experts quoted by the Japan Times say there is no firm evidence of it.

Cyber Attack Malaysia: Government Warning After a Run of Incidents

On 3 November, Prime Minister Anwar Ibrahim said Malaysia is a target for cyberattacks and ordered top-level coordination across agencies, without naming any suspected attackers.

It follows a string of 2026 incidents:

  • March: an attack on Malaysia Airports Holdings, with a US$10 million ransom demand that the government rejected.
  • 26 June: the Ministry of Health website was defaced, and other agency sites were hit. The national agency NACSA urged Joomla updates.
  • 30 June: the Flexi Parking payment system was disrupted in Selangor and other areas.
  • Early November: bank service disruptions coincided with a surge in attack activity, an expert said, though the cause has not been confirmed.

The anti-corruption agency says it blocks up to 90,000 attempted attacks a day, and the Cyber Security Act 2024 provides the legal base for protecting critical information infrastructure.

Cyber Attack South Africa: Government Breaches and Hacktivism

In March, the national statistics agency Stats SA confirmed a ransomware attack. The group behind it claimed to have taken 154 GB of data and demanded US$100,000. In May, hacktivists linked to Nigeria targeted South African government bodies in retaliation for xenophobic violence, and a wave of DDoS attacks hit hosting providers and the Seacom cable. The vehicle tracking firm Cartrack confirmed a ransomware attack on 26 August.

The volume is high. Check Point found South African organisations averaged 2,065 attacks a week in June, and Interpol reported that African cybercrime losses have more than doubled since 2024 to US$484 million, with South Africa heavily targeted.

Cyberattacks on Banks: Why Finance Stays the Top Target

Financial services face more attack attempts per device than any other industry: SonicWall counted 132,378 intrusion-prevention hits per device in the first half of 2026. A KPMG survey found 76% of US bank executives had seen cyberattacks rise.

Three patterns stand out:

  • Disruption: Russian-linked hacktivists have run DDoS campaigns against German banks since 2023, and the Iran war led analysts to warn US and Gulf banks of DDoS and wiper attacks.
  • Social engineering: AI-generated phishing, cloned voices and fake video calls are the fastest-growing technique.
  • Third parties: attackers increasingly go through cloud, software and fintech suppliers, and ransomware groups are shifting toward smaller regional banks with fewer defenders.

Are Website Defacement and DoS Possible Cyberattacks Against Websites?

Yes, both are well-established cyberattacks against websites, and both appeared in 2026.

Website defacement changes what visitors see, usually by exploiting a flaw in the content management system or by using stolen admin credentials. It attacks integrity, and it proves the attacker had write access. Malaysia’s Ministry of Health site was defaced in June.

Denial of service (DoS) overwhelms a server with requests so real users cannot get through, and a distributed attack (DDoS) does this from many machines at once. It attacks availability. Examples this year include campaigns against German banks and Russian government sites.

Neither steals data by itself, but each damages trust and can mask a deeper intrusion. Patching the CMS, enforcing multi-factor login for admins, using DDoS protection and keeping tested backups are the standard defences.

Types of Cyberattacks That Commonly Target Faculty and Staff

Schools and universities hold student records and research data on open, widely shared networks, and staff are usually the way in. The attacks that most often target faculty and staff are:

  • Phishing and spear-phishing: fake email or learning-platform login pages. Phishing was the biggest incident category in New Zealand.
  • Credential stuffing and password spraying: reused or guessable passwords tried at scale against email accounts.
  • Business email compromise: a fake message from a senior colleague or supplier asking to change bank details or pay an invoice.
  • Ransomware and data extortion: increasingly based on threatening to publish stolen data rather than encrypting it.
  • Supply chain compromise: the May 2026 Canvas breach reached major New Zealand tertiary providers through a shared platform.
  • Espionage against research: state-linked actors target intellectual property, especially in AI and technology.
  • AI-assisted impersonation: cloned voices and fake video requests that look like a trusted colleague.

Multi-factor authentication, short regular training and a clear way to report suspicious messages cut the risk from nearly all of these.

How to Reduce Your Risk

Most of this year’s incidents exploited basic gaps rather than new techniques. Eight steps cover the lessons above:

  1. Change default passwords on every device, including refrigeration, cameras and building controls.
  2. Keep control systems and connected equipment off the public internet, or behind a VPN with multi-factor login.
  3. Patch promptly, and replace equipment whose maker no longer issues security updates.
  4. Turn on multi-factor authentication for email, admin accounts and remote access.
  5. Keep offline backups and test restoring them.
  6. Keep an inventory of everything connected to your network, including devices run by suppliers.
  7. Ask suppliers how they secure remote access to your systems.
  8. Write down and rehearse an incident plan, and report serious incidents to your national cyber agency, such as New Zealand’s NCSC.

Contact Advanced Computers If You Need Help

If working through that list feels like a lot, you do not have to do it alone. Advanced Computers is an Auckland-based computer and technology company that has been helping home users and businesses since 1998, with virus removal, data recovery and IT support plans, plus customised IT solutions for businesses. A conversation with a local team about what is connected to your network and how it is looked after is a sensible first step.

Sources

Posted in blog.