A bizarre wave of cyberattacks has hit Europe, not by stealing data, but by turning supermarket freezers into heaters. These events, causing food to be destroyed, expose a major vulnerability in our daily lives and reveal a crucial gap in cybersecurity.
An Attack on the Cold Chain
In early November 2026, supermarkets across at least seven European countries, including Italy, Sweden, Belgium and Ireland, reported a strange and destructive phenomenon. Staff arrived to find refrigeration and freezer units malfunctioning, with temperatures soaring as high as 50 degrees Celsius. Attackers had remotely accessed the internet-connected industrial control systems that manage the cooling units, in some cases switching them to a 'defrost' mode that actively heated the cabinets. The result was spoiled meat, melted frozen goods, and significant financial losses, with one butcher estimating €15,000 in ruined products alone. These incidents were not isolated; they followed a similar, large-scale attack on hundreds of French supermarkets just weeks earlier. The events highlight the vulnerability of what is known as operational technology (OT)—the hardware and software that controls physical equipment in our critical infrastructure.
Reporting the Breach: The First 24 Hours
When an attack like this occurs, the first step is detection and reporting. A store manager notices the temperature anomaly, or a remote monitoring service flags an issue. At this stage, the focus is purely on damage control: Is the food safe? Can the system be disconnected from the internet and manually reset? Technicians are mobilized, sometimes in the middle of the night, to contain the breach and assess the damage. The incident is reported to the company's IT security team, and often to national authorities. In Europe, the NIS2 Directive mandates that companies in critical sectors, which now explicitly includes food production and distribution, must report significant cyber incidents. This initial report simply states that an attack has happened. It is a declaration of a problem, not an explanation of who is behind it. Belgian federal prosecutors have opened a criminal investigation, but this is the beginning of a long road.
The Attribution Puzzle: Who Did It?
This is where the second, much harder part begins: attribution. Attributing a cyberattack means identifying the individual, group, or nation responsible. This is vastly more complicated than just knowing you've been attacked. Cybercriminals and state-sponsored actors are experts at covering their tracks. They use compromised servers, anonymous infrastructure, and deceptive techniques to hide their origin. Investigators look for technical clues like unique malware code or specific Tactics, Techniques, and Procedures (TTPs) that might link the event to a known threat actor. However, even this can be misleading, as groups often share or mimic each other's tools to create false flags. While officials investigate possible connections, and some researchers point to previous operations by pro-Russian hacking groups, no official attribution for the freezer attacks has been made. As of now, authorities have confirmed they don't know who is responsible, and may never be able to say for certain.
Why the Distinction Matters
The gap between a reported attack and a confirmed attribution has massive consequences. An unattributed attack is treated like a sophisticated crime, investigated by law enforcement. An attack confidently attributed to a nation_state, however, becomes a geopolitical incident. It can trigger diplomatic protests, economic sanctions, and even retaliatory actions. Publicly blaming a country requires an extremely high burden of proof, as misattribution can lead to severe international fallout. For the affected businesses, attribution helps understand the motive—was it a ransomware group seeking financial gain, or a state actor aiming to cause disruption and undermine public confidence in the food supply chain? Without clear attribution, companies and governments are left to bolster defenses against a shadowy, undefined threat, unsure if they are fighting criminals or repelling a new form of hybrid warfare.
