A series of cyberattacks targeting refrigeration units in European supermarkets has led to widespread food spoilage, exposing significant security flaws in operational technology and prompting concerns about potential state-sponsored cyber warfare.
The incidents began on October 11, when French supermarkets experienced an unprecedented cyberattack affecting approximately 700 stores. In the most severely impacted locations, freezer temperatures rose to 80°C, leading to fires and the spoilage of food worth hundreds of millions of euros. Major chains such as Cooperative U, Carrefour, Intermarche, Monoprix, and Netto were affected.
Just three weeks later, on November 1, a second wave of attacks hit around 100 stores across Europe, including in Sweden, Belgium, Ireland, Finland, Luxembourg, and the Netherlands. This resulted in the loss of chilled and frozen food valued at tens of millions of euros, with temperatures in some units soaring from minus 27°C to over 50°C. EU agriculture and food commissioner Christophe Hansen described the second attack as a “deliberate attempt to disrupt our food supply-chain.”
These attacks caused temporary shortages and empty shelves in supermarkets. While larger processing and storage facilities were unaffected, allowing for eventual restocking, the incidents have amplified concerns about supply chain readiness, particularly as governments encourage citizens to stockpile for emergencies.
Investigations into the attacks revealed that they were enabled by "basic security flaws" in widely used computer software, according to Vincent Strubel, head of the French cyber security agency ANSSI. These vulnerabilities are believed to be prevalent in Britain's "operational technology"—everyday internet-connected devices like fridges and fire alarms that are often not prioritized for cyber protection. The increasing capabilities of AI are cited as a factor that makes discovering and exploiting such weaknesses easier and faster.
No group has claimed responsibility, and no ransom has been demanded, leading to speculation about the motives. Some experts suggest the attacks could be a form of "shadow warfare" orchestrated by nation-states. Britain's National Cyber Security Centre (NCSC) warned in its annual review that by 2028, nations like China and Russia will likely routinely use AI for cyber operations to achieve geopolitical goals, with the UK anticipating an increase in the scale and speed of sophisticated attacks.
Experts note that many refrigeration systems were secured using "default credentials," such as basic, pre-set passwords found in easily accessible instruction manuals. This allowed hackers to gain access "through the front door." Once inside, they could manipulate the units into "defrost" mode, rapidly increasing temperatures and locking out store operators. Restoration of normal operations often required disconnecting the refrigeration systems from the digital network and reverting to manual control.
Daniel Des Santos, vice president of research at cyber security firm Forescout, explained that beyond default passwords, hackers may have exploited vulnerabilities in the underlying computer code. He noted that AI significantly accelerates the process of finding such flaws, which previously required extensive manual effort.
"Vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable," stated Richard Horne, chief executive of the UK's NCSC. He suggested that Britain has historically "done tech on the cheap," leaving it increasingly vulnerable to AI-enabled cyber warfare.
The perpetrators remain unidentified, though potential suspects include Iran and Russia, known for engaging in such disruptive tactics. Gerome Billois of cybersecurity firm Wavestone suggested the attacks aim to instill fear and undermine public confidence in government preparedness.
Ciaran Martin, former head of the NCSC, expressed concern that these incidents could be experimental precursors to further attacks. He highlighted healthcare as a particularly vulnerable sector, where disruptions to data processing could force hospitals to cancel operations and divert ambulances, even without direct infrastructure failure.
Martin cautioned against viewing cyber threats solely as large-scale "cyber spectaculars." Instead, he warned of a more insidious threat: "everything, everywhere, all at once"—a barrage of hundreds of low-level disruptive attacks that could significantly destabilize the economy and society. He drew parallels to previous major cyber incidents in the UK affecting companies like Marks & Spencer and Jaguar Land Rover, suggesting these recent attacks could be a scaled-up version, but with the aim of sowing chaos rather than financial gain.