The hacker groups' mysterious "evidence" for the freezing attacks is seen

The day after the freezing attacks, on November 3, the hacker group NoName057(16) published two files with email addresses and passwords on the dark web. The files were presented as evidence that the group is behind the attack along with hackers from the Z-Pentest Alliance.

But SVT's review shows that the email addresses appear in previous data leaks. The lists cannot therefore be used as evidence of any new breach, according to four security analysts contacted by SVT.

- The material itself does not prove that they have actually changed any settings in the cooling facilities, says Sai Molige, head of threat analysis at the IT security company Forescout.

- Real evidence would have been data only found inside the victims' own systems, such as internal configurations, store IDs or time-stamped screenshots, says Maxime Arquillière, analyst at the IT security company Sekoia.

Unnecessary information

Passwords are not necessarily needed to carry out this type of attack.

- Some Danfoss units can be accessed without login details, says Maxime Arquillière.

The stores' coolers are controlled by software from the Danish company Danfoss, which had known security flaws. Because of them, hackers have been able to bypass the login.

The cooling systems that were attacked were not on a secure network and had default passwords, a Danfoss spokesperson told Dutch NOS.

In October, Danfoss is said to have urged its Dutch customers to disconnect their systems from the internet and reconnect via a secure network.

"No Ransoms"

The hacker group does not provide an explanation in its published post as to how the login details should have been used.

"No malware, no ransomware, no ransoms. Simply proper operation of the functions originally built into the equipment by the manufacturer," the method says in a post they shared on Telegram.

Don't want to comment

The company Danfoss does not want to comment on the data.

"There are no signs of a successful attack on Danfoss' internal IT infrastructure or of a breach of data security. We cannot confirm the specific information that the hacker groups have published, and we do not want to speculate on who is behind it." they write in a statement to the Danish DR.

What do the files contain – and what do we know about those responsible? Watch our review in the video above.