Europe is discovering that the infrastructure underpinning everyday life can be turned against it.
There is something unsettling about walking into a supermarket and finding the refrigerators empty. Not because of a strike, a supply shortage or a power cut, but because somebody, somewhere, has remotely turned up the temperature.
That is precisely what happened across several European countries this week. Supermarket refrigeration systems in Belgium, Sweden, Luxembourg, the Netherlands, Estonia, Finland and Ireland were affected by suspected cyberattacks. In some cases, temperatures reportedly reached 50C resulting in spoiled food and shops forced to remove.
In Belgium alone, around 75 shops were reportedly affected, including branches of Delhaize, Carrefour, Intermarché and IKEA.
This followed an attack in France on 12 October, when the refrigeration systems of hundreds of supermarkets were reportedly compromised, causing millions of euros in damage.
The weaponisation of everyday infrastructure
Modern supermarkets rely on interconnected systems to monitor refrigeration, heating, security and stock management and these systems are increasingly accessible remotely, allowing technicians to monitor and adjust equipment without physically visiting individual stores.
If an attacker gains access to an inadequately protected refrigeration controller, they may be able to change its settings and cause significant damage without deploying sophisticated malware or physically entering the premises.
The Guardian’s reporting has highlighted the possibility of outdated software, exposed internet connections and poorly protected operational technology. Some of the systems involved in the French attacks were reportedly supplied by Danish manufacturer Danfoss, which had previously identified security vulnerabilities and recommended software updates.
Reuters reported that the latest incidents affected retailers across several countries, while cybersecurity specialists warned that retail networks are attractive targets because they contain large numbers of remotely managed devices. The absence of obvious ransom demands has also raised the possibility that the objective may be disruption rather than financial gain.
A wider European security problem
Nevertheless, the attacks are taking place against a backdrop of increasing concern about hybrid warfare.
European governments have repeatedly warned about sabotage, cyber operations, disinformation and suspicious activity around critical infrastructure. Since Russia’s full-scale invasion of Ukraine in 2022, European intelligence officials have described a growing campaign of hostile and often deniable activity directed at Western countries.
The objective of hybrid warfare is not necessarily to defeat an adversary militarily but more so to create uncertainty, disrupt essential services and expose divisions within European societies.
A supermarket refrigerator may seem an unlikely instrument in such a campaign, however, its symbolism is powerful. The disruption of food security creates anxiety and undermines confidence in institutions and businesses, and even governments.
Agriculture EU Commissioner Christophe Hansen in an interview with POLITICO stated that the Commission would examine supermarkets’ preparedness and discuss the attacks within its Security College. He warned that Europe’s food supply chain must be prepared for evolving threats.
This demonstrates that cybersecurity is increasingly being treated as a question of economic and national security, rather than simply an IT department’s responsibility.
And what about Revolut?
The recent Revolut outage offers another illustration of Europe’s digital vulnerability, although it is important not to confuse it with the supermarket attacks.
On 20 October, millions of Revolut customers experienced disruption across several countries, with many not being able to access their accounts, make card payments or transfer money.
The disruption appeared to originate from a power-related failure at a Google Cloud data centre near London. Google described the incident as a power event, and Revolut subsequently confirmed that services had been restored.
There is no established evidence that this outage was the result of a cyberattack.
Revolut also faced a separate security incident in September, when cybercriminals impersonating government officials persuaded the company to disclose sensitive information belonging to nearly 700 customers.
These incidents illustrate different vulnerabilities: malicious intrusion, human and organisational failure, and dependence on external digital infrastructure.
Is Europe under threat?
Europe is increasingly exposed to operations that can disrupt its economy, undermine public confidence and exploit weaknesses in essential infrastructure.
The EU’s cybersecurity agency, ENISA, has warned that geopolitical tensions continue to shape the cyber threat landscape, with ransomware, politically motivated attacks and cyberespionage all posing significant risks. The growing use of artificial intelligence could make it easier to identify vulnerabilities and automate attacks.
That being said, the uncomfortable reality is that Europe’s security can no longer be measured solely by the strength of its armies, the sophistication of its weapons or the resilience of its borders. It must also be measured by the security of the systems that people barely notice until they stop working.
Even though Europe may not know who is behind these attacks, what it should know by now is that the vulnerabilities are real, the consequences are no longer theoretical, and the next warning may come from somewhere far more consequential than a supermarket aisle.
(Sources: Politico, Euronews, Reuters, The Guardian, European Union Agency for Cybersecurity)
Read more:
