Supermarket fridges, a lending platform for small banks, and two hijacked alert apps
Three unrelated disruptions in 24 hours, each in a system people rely on without thinking about it. None is shown to be linked to the others.
Cybersecurity. Critical Infrastructure. Financial Risk. Evidence register as of 2026-11-02 21:25 UTC.
The big picture
Disruption in everyday systems, with partial recovery, and no evidence of a common thread
Overnight from 1 to 2 November, refrigeration systems at supermarkets in at least four European countries were tampered with, warming fridges and freezers. It is the second wave in three weeks, after attackers took control of refrigeration in hundreds of French stores in October.Corroborated1,2,3
In the United States, Abrigo restored most of its Sageworks lending platform for banks and credit unions on 2 November after three days offline. Abrigo describes the trigger only as irregular activity in its environment and has not said what it was.Confirmed4,5
Within hours of each other, public warning apps in Ukraine and Russia pushed false nuclear and chemical alerts. Both governments say their sirens and broadcast channels are separate systems.Corroborated6,7,8
No source links these three events to each other. The two alert apps were hit within hours of each other, but the timing is the only thing they have been shown to share. Claimed actors differ, and neither government has published a technical finding.Analysis7,8
What happened
- 1
Supermarket fridges and freezers tampered with overnight in at least four European countries
Retailers in Belgium, Sweden, Ireland and Estonia confirmed tampered refrigeration, three weeks after a similar wave hit hundreds of French stores. Reports from three more countries are less firm.
- Register record
- European supermarket refrigeration · fl-f5-01Corroborated · Confirmed operational disruptionOccurred: 2026-11-01 night to 2026-11-02 morning (local)
Disclosed: 2026-11-02 (retailer statements via Belga, Le Soir, TT, ERR, Musgrave via Euronews)
Last verified: 2026-11-02 21:25 UTC - Register record
- French supermarket refrigeration · fl-f5-02Corroborated · Confirmed operational disruptionOccurred: 2026-10-11/12 night; second wave on Dixell units 12/13 Oct
Disclosed: 2026-10-12 (CERT-FR ALE-012)
Last verified: 2026-10-29 (AP); no newer French status found
Who is affected. Supermarket chains in Belgium, Sweden, Ireland and Estonia, each named below with its sources. Reports from Luxembourg, the Netherlands and Finland are labelled separately.
During the night of 1 to 2 November, refrigeration systems at supermarkets were tampered with so that fridges and freezers warmed.Corroborated1,2,3
Belgium: Delhaize, Carrefour Belgium and Spar stores (operated by Colruyt Group) were affected, Delhaize in several dozen stores.Corroborated1,2,3
ICA's Kvantum store in Sjobo, Sweden, said its units had been set to 50 C. Carrefour said the impact on its Belgian stores was extremely limited.Reported1
Sweden: ICA reported a limited number of affected stores, and Coop six stores in central Sweden. Estonia: one Selver store was affected.Corroborated1,2,3
Ireland: 13 SuperValu stores were affected. Musgrave says all of them were operating normally by the evening of 2 November, after chilled and frozen products were removed from sale as a precaution.Corroborated2,9
Luxembourg is contested. AP reports that a few stores there were affected, while Euronews reports only a precautionary suspension of ordering systems. No company is named because the reports conflict.Reported1,2
Netherlands: a Danfoss spokesperson says the cooling systems of at least 17 unnamed companies were attacked. Finland: Finnish media report that several supermarkets were affected. Each rests on a single report, so no company there is named.Reported2
Stores stayed open and no shortage has been reported. Belgium's federal prosecutor has opened an investigation.Reported2
Why it mattersThis is the second wave. On 12 October, France's national cyber agency (CERT-FR) warned that the campaign against remote refrigeration controllers was probably ongoing, and that exposed end-of-life units would be compromised again.Confirmed10
Danfoss says customers who had not updated their software were affected. Sabcobel, which manages Delhaize's refrigeration in Belgium, says a software update alone is not enough and physical modifications are needed.Reported2
The risk this exposes is not food supply. It is remote access to building equipment. Controllers that can be reached remotely can be switched by whoever gains access to them, at many sites in one night. No authority has yet said how the November wave got in.Analysis10,2
Documented connectionsNot yet established- Whether the November wave is the same actor as the October wave. No group has claimed either.
- How the attackers got in. No authority has named a method for the November wave.
- Total food losses in any country.
- 2
A lending platform used by community banks was offline for three days. The cause is not stated.
Abrigo's Sageworks platform was back for lenders on 2 November, but the borrower-facing portal was still down. Abrigo has not said what the irregular activity was.
- Register record
- Abrigo · fl-f6-01Confirmed · Suspected security incident · cyber cause not establishedOccurred: unknown; irregular activity identified 2026-10-30
Disclosed: 2026-10-30T14:58Z first status post (10:58 EDT); cause first stated 2026-10-30T17:27Z (13:27 EDT); press 2026-11-02 (BleepingComputer)
Last verified: 2026-11-02 21:25 UTC
Who is affected. Lenders at banks and credit unions that use Abrigo's Sageworks Analyst, Sageworks API and Online Portal Now, and the borrowers sending them loan documents. The number of institutions is not known.
On 30 October, Abrigo's status page reported that it had identified irregular activity in its environment and took the Sageworks applications offline as a precaution.Confirmed4
From 30 October to 2 November, lenders lost access to loan analysis, credit memo, portfolio and API functions. At 12:11 UTC on 2 November, Abrigo said the platform was available again except for its borrower-facing capabilities.Confirmed4
BleepingComputer notes that the platform holds borrower financial data, and reports that some researchers advised customers to rotate their Sageworks API keys.Reported5
Why it mattersAbrigo has not said this was a cyber incident, and no access to customer or borrower data has been confirmed. The confirmed fact is the outage.Confirmed4,5
Small banks and credit unions often share the same few software vendors. When one of those platforms goes down, loan work stops at many institutions at the same time, a concentration that no single bank's own risk report shows.Analysis4,5
Not yet established- How many banks and credit unions were affected.
- Whether any data or API credentials were accessed.
- When the borrower portal will return.
- 3
False nuclear and chemical warnings sent through public alert apps in Ukraine and Russia
Both apps sent false alerts within hours of each other. Both governments say their sirens and broadcast channels kept working.
- Register record
- Air Alert app (Ukraine) · fl-f5-05Corroborated · Confirmed operational disruptionOccurred: 2026-11-01 22:47 Kyiv (20:47Z)
Disclosed: 2026-11-01 (Air Force Telegram, app developers)
Last verified: 2026-11-02 13:59 UTC (Kyiv Independent update) - Register record
- MChS warning app (Russia) · fl-f5-06Corroborated · Confirmed operational disruptionOccurred: 2026-11-02 about 02:45 Moscow (2026-11-01T23:45Z)
Disclosed: 2026-11-02 (ministry social media statement, via TASS and AP)
Last verified: 2026-11-02 14:35 UTC (AP)
Who is affected. Users of Ukraine's Air Alert app, and users of the Russian Emergencies Ministry app in 33 regions, according to Russian media cited by AP.
At about 22:47 Kyiv time on 1 November, Ukraine's Air Alert app sent users false warnings of radiation, a chemical threat and an imminent nuclear attack. Ukraine's Air Force corrected them within about 10 to 15 minutes. The app's developers suspended push notifications that night and restored the app gradually from 02:00 on 2 November.Corroborated8,6,7
About three hours later, Russia's Emergencies Ministry app sent alerts claiming nuclear warheads had been launched and telling residents to shelter. The ministry says it found a vulnerability in the app's administrative panel and isolated the affected services. As of AP's 2 November report, the app was still being restored.Corroborated7,6
Ukraine's Air Force says the app is separate from military command systems. Russia's ministry says SMS, broadcast and siren warnings kept working.Corroborated11,7
Why it mattersNot yet established- Who was responsible for either incident. Claims by named groups on Telegram are unverified.
- How the Ukrainian app was entered: the vendor backend, administrator credentials or the push provider.
- Whether sirens sounded in Ukraine. The Kyiv Independent says they did nationwide, while ABC cites the ministry saying the sirens worked normally.
The Capital Connection
ConnectWise: every lender valuation on record predates the intrusion
Huntress, a security firm responding to the incident, found that credentials of ConnectWise's Microsoft cloud applications were used to sign in to customers' Microsoft 365 tenants. It confirmed unauthorized sign-ins in over 300 tenants by 17 October, with the main activity on 15 October.Confirmed12
ConnectWise's advisory, first published on 16 October and last updated on 30 October, says restoration phases 1 and 2 are complete and phase 3 is in progress. Containment inside customer tenants has not been confirmed.Confirmed13
The 30 June 2026 schedules of investments show 14 BDC funds holding ConnectWise first-lien loans directly, maturing in September and October 2028: $187.17M at fair value against $203.49M at cost.Confirmed14,15,16,17,18,19,20,21,22,23,24,25,26,27
Two New Mountain funds hold further ConnectWise positions through senior loan program joint ventures: $20.07M at fair value against $21.73M at cost, one of them not classified by lien. Together with the direct holdings, that is $207.24M at fair value and $225.22M at cost.Confirmed28,29
DFX's quarter-by-quarter reading of the holders' schedules puts the marks at about 101% of cost in June 2025 and 92% in June 2026, a decline that happened before the incident. The 30 September 2026 marks also predate the incident. The first quarter-end valuation that can reflect it is 31 December 2026.Analysis30
None of this says the marks will move. It says the last valuation round could not have weighed a vendor compromise that reached customers' own tenants, so the question is open now in a way it was not in June.Analysis13,12
- Has the borrower notified lenders of the incident under its reporting covenants, and when?
- What remediation, credit or indemnity costs has ConnectWise committed to customers, and how are they funded?
- The marks fell from about 101% to 92% of cost in the year before the incident. What drove that, and does the incident change the view?
Fair values are the lenders' own quarterly marks, a lower bound on exposure because banks, CLOs and private funds that file no schedule are not included. A relationship is not an impact: no lender is said to have suffered a loss.
Why this ran: the financial relevance review
DFX covers the company, holds verified financed by relationships, the cyber cause is confirmed, and the Changed Conditions finding is newly relevant: Immediate review warranted: A confirmed compromise whose containment is not confirmed, disclosed after the last valuation, on a credit the lenders were already marking down.
A cyber reader learns that a vendor compromise sits on top of a loan that lenders were already marking down. A credit reader learns which valuation dates can and cannot reflect it.
What to watch
- An advisory from CERT-EU, Belgium's CCB or another national CERT naming the affected controller models, or a Danfoss customer notice. Record
- An Abrigo status update naming the cause of the irregular activity, and the return of the borrower portal. Record
- A post-incident report from CERT-UA or the Air Alert developers naming how the app was entered. Record
- A ConnectWise advisory update marking restoration phase 3 or 4 complete, or stating the root cause. Record
One practical action
Find the building controllers that answer to the internet
If you run or lease a site with refrigeration, heating, ventilation or access-control equipment, ask your facilities team or service contractor one question this week: can any controller be reached from the internet, and with whose login? If the answer is yes, put it behind a VPN or take it offline, and change any shared or default credentials. Contractors often hold the remote access, so ask them directly.
CERT-FR's October alert concerns remote refrigeration controllers that were reachable from the internet.Confirmed10
Also new on the register
- Mercado BitcoinConfirmed financial consequence · crypto exchange · Brazil
- Spandana SphoortyConfirmed financial consequence · non-bank lender / microfinance · India
- Baanx USConfirmed compromise · financial services (crypto card program) · United States (Dover, DE entity; notices to CA and other states' residents)
- El Camino HealthConfirmed compromise · healthcare (hospital system) · California
- HCA HealthcareConfirmed compromise · healthcare (hospital system) · United States (Nashville, TN headquarters; HCA-affiliated facilities and physician offices; at least 15,096 Texans per a claims-site summary of the Texas filing)
- Marathon HealthConfirmed compromise · healthcare · United States (Texas 234,534; Massachusetts 29,075; Vermont 8,858 per secondary summaries of state filings)
Lenders and owners who want an incident checked against a specific borrower or portfolio company can see how DFX does it. How a Cyber-Triggered Credit Review works.
Sources
- 1Freezers at supermarkets in several European countries hit by apparent cyberattacks, ruining food (AP) · 2026-11-02
- 2Cyberattacks hit supermarket fridges and freezers in Europe, Belgium launches investigation · 2026-11-02T10:25Z (updated 15:55Z)
- 3Another fridge cyberattack hits European supermarkets, this time in Belgium, Luxembourg, Sweden and Estonia · 2026-11-02 (update 19:00Z)
- 4Abrigo status page: Sageworks Analysis, Sageworks API and Online Portal Now Unplanned Maintenance · 2026-10-30T14:58Z (first post); latest 2026-11-02T12:11Z
- 5Fintech platform Sageworks taken offline after suspected cyberattack · 2026-11-02 (14:00, page time zone)
- 6Ukraine and Russia's emergency alert apps both hacked, residents warned of fake nuclear, chemical strikes · 2026-11-02T17:28Z (updated)
- 7Ukraine and Russia both report fake emergency alerts after cyberattacks target apps as limited ceasefire ends (AP) · 2026-11-02T14:35Z
- 8Ukraine's air raid alert system hacked, Russian system targeted hours later · 2026-11-01 23:29 Kyiv (updated 2026-11-02 15:59 Kyiv)
- 9SuperValu stores hit by cyber attack now back to normal · 2026-11-02 (updated 19:56Z)
- 10CERTFR-2026-ALE-012: compromissions de controleurs a distance d'installations de refrigeration · 2026-10-12 (updated 13 and 16 Oct)
- 11Ukraine's public alert app sends false warnings after being hacked · 2026-11-02T02:05Z (Sydney 13:05)
- 12Huntress: Vendor credential enables unauthorized access · 2026-10-16 (updated 2026-10-27T18:30Z)
- 13ConnectWise Trust Center advisory: Cloud Backup (formerly SkyKick) Service Interruption · 2026-10-16T17:47Z (last updated 2026-10-30T21:00Z)
- 14ARES STRATEGIC INCOME FUND: SEC filing 0001628280-26-054923 (period 2026-06-30)
- 15Blue Owl Credit Income Corp.: SEC filing 0001812554-26-000047 (period 2026-06-30)
- 16Golub Capital Private Credit Fund: SEC filing 0001930087-26-000099 (period 2026-06-30)
- 17Blue Owl Technology Finance Corp.: SEC filing 0001747777-26-000028 (period 2026-06-30)
- 18Goldman Sachs Private Credit Corp.: SEC filing 0001193125-26-340582 (period 2026-06-30)
- 19Antares Strategic Credit Fund: SEC filing 0001193125-26-349216 (period 2026-06-30)
- 20Palmer Square Capital BDC Inc.: SEC filing 0001193125-26-333791 (period 2026-06-30)
- 21Blue Owl Technology Income Corp.: SEC filing 0001869453-26-000053 (period 2026-06-30)
- 22Franklin BSP Capital Corp: SEC filing 0001825248-26-000024 (period 2026-06-30)
- 23Ares Core Infrastructure Fund: SEC filing 0002031750-26-000064 (period 2026-06-30)
- 24Antares Private Credit Fund: SEC filing 0001193125-26-349158 (period 2026-06-30)
- 25Golub Capital Private Income Fund I: SEC filing 0002082559-26-000086 (period 2026-06-30)
- 26Golub Capital Private Income Fund S: SEC filing 0002082557-26-000059 (period 2026-06-30)
- 27Steele Creek Capital Corp: SEC filing 0001213900-26-089899 (period 2026-06-30)
- 28New Mountain Finance Corp (through a senior loan program joint venture): SEC filing 0001496099-26-000029 (period 2026-06-30)
- 29New Mountain Private Credit Fund (through a senior loan program joint venture): SEC filing 0002037804-26-000015 (period 2026-06-30)
- 30DFX Changed Conditions: ConnectWise mark history, compiled quarter by quarter from the funds' SEC schedules of investments
Evidence labels: Confirmed, Corroborated, Reported, Analysis, Unknown. Hover a label for its meaning, or read the methodology. Found an error? Corrections are public and dated. Edition built 2026-11-03 07:25:17 UTC from the register compiled 2026-11-03 06:52:49 UTC.