The shop is about to open, but a refrigerated display is reporting an abnormal temperature. The maintenance contractor checks the equipment, the store manager inspects the goods, and management tries to establish whether other branches have the same problem. Amid these activities, one question remains: who could intervene remotely on the equipment, and what was actually changed?
On 2 November 2026, ANSA reported attacks on the refrigeration systems of Coop-branded supermarkets operated by the Radenza group in Sicily, based on statements by executives. According to the group, temperatures had allegedly been altered through remote controls, causing food to spoil. The postal police were investigating the origin, extent and possible connections with incidents in other countries. The report dates from 2 November; the source does not establish the precise date of each individual incident. [1]
On the same day, Adnkronos obtained direct confirmation from Coop Radenza’s general manager and reported alerts from Italy’s National Cybersecurity Agency concerning businesses in Tuscany and Emilia-Romagna as well. This is additional journalistic reporting, rather than a forensic examination of the systems. The sources consulted do not demonstrate a single coordinated operation or allow the attacks to be attributed to any actor or state. [2]
The maintenance contract does not explain every access
For a business, the lesson extends beyond refrigeration: a purchased service often includes the ability for others to intervene in an essential process. The commercial contact may have been known for years, while the people carrying out the work change. The question to put to the supplier is specific: which company currently provides support, through which personnel and with which subcontractors, if any?
A useful reconstruction begins by comparing the contract, work orders and actual operating arrangements. If the service has passed to another business, who authorised the change? Does the emergency number belong to the contracted entity? Who responds when the installer and the software operator give different explanations? These questions do not presume misconduct: they help identify contacts and responsibilities before an interruption occurs.
The CSIRT Italia bulletin dated 13 October, consulted in the institutional reproduction by CSIRT Toscana, recommends limiting supplier access to authorised resources and periods, logging activities and revoking permissions when work ends. Technical verification therefore also requires a business decision about who is entitled to intervene. [3]
A shared timeline is worth more than separate explanations
When an anomaly emerges, each function sees part of the incident. The store knows the alarm time; the maintenance contractor knows when it intervened; the administration team holds the contract and communications. Bringing these elements together in a timeline allows accounts to be compared without immediately selecting someone to blame.
For each step, record the time, the source of the information and what remains to be checked. “The technician changed the setting” is a conclusion; “at 6:15 the technician reported by email that they had found that value” is a documentable fact. Even a plausible explanation should be linked to an intervention, a communication or a technical finding.
The bulletin calls for logs and configurations to be preserved insofar as this is compatible with securing the systems. Restoration should be coordinated with those responsible for the equipment, avoiding indiscriminate interventions. [3] Organisationally, it is useful to establish who collects documentation and who handles suppliers, specialists and authorities, so that requests do not produce contradictory accounts.
Understand the extent before reassuring customers and partners
A problem at one branch raises a second question: do the others depend on the same service? Management can ask for a clear map of the stores, the equipment covered and the businesses involved, without going into configuration details. Knowing that two branches have different maintenance contractors does not clarify whether they also use a shared platform.
Commercial communications should reflect the checks available. If a customer asks whether delivery is guaranteed, it is preferable to state what has been checked and when the next update will arrive. A general promise can become difficult to sustain if the incident turns out to be more extensive a few hours later.
The return of equipment to its expected temperature does not, by itself, establish that the goods have been kept under adequate conditions: that assessment belongs to those responsible for food safety. [3] Management has a separate task: reconstructing decisions, contacts and economic consequences, preserving a verifiable basis for any subsequent disputes.
GRISK can support checks on the businesses involved in outsourced services and the documentary reconstruction of relationships and anomalies when an incident requires investigative follow-up.
Sources and editorial note
The news reports date from 2 November; the technical bulletin dates from 13 October and is not a new November publication. The ACN original returned HTTP 403: the text was read in the reproduction on the institutional CSIRT Toscana website. No public forensic reports on the cited incidents are available. The proposals for managing relationships and communications are the article’s operational assessments. No responsibility is attributed to suppliers, and GRISK is not presented as a provider of technical interventions on equipment.
- ANSA, “Attacchi hacker a sistemi refrigerazione dei supermercati della Sicilia”, 2 November 2026. Statements by executives.
ANSA report - Adnkronos, “ ‘Freezer guasti, manomessi dagli hacker’: gli attacchi in Toscana, Emilia Romagna e Sicilia”, 2 November 2026, 19:44. Statements collected by the outlet and ACN communications.
Adnkronos report - CSIRT Italia, “Misure urgenti di verifica e mitigazione per operatori della distribuzione alimentare e della filiera del freddo”, BL01/261013/CSIRT-ITA, 13 October 2026; institutional reproduction by CSIRT Toscana, consulted on 3 November 2026.
CSIRT bulletin