Cyberattack disabled refrigerators in supermarkets across 9 EU countries

Full text

Two major cyberattacks on European supermarkets in a matter of weeks have exposed the vulnerability of the EU’s critical infrastructure. Cyber experts are raising the alarm that the attacks may be part of Russia’s ongoing hybrid warfare against Europe.

Refrigerators in supermarkets in at least nine EU countries went out of service Monday, in what appears to be a repeat of cyberattacks that hit French stores on Oct. 11-12. Stores in Belgium , Luxembourg , Sweden , Germany , Ireland , the Netherlands , Estonia , Finland and Romania were among those affected, according to local news reports and spokespeople for affected supermarkets.

The European Commission’s top security officials will look into the incidents, POLITICO reported Monday, with EU Agriculture and Food Commissioner Christophe Hansen describing the attacks as a “deliberate attempt to disrupt our food supply chain.”

Identifying who’s responsible for a cyberattack is a tricky business, mired in uncertainty and couched in gradations of likelihood. Even once the technical work is complete, governments often hold back from formally pinning the blame for political, diplomatic or intelligence reasons.

“It is not known who is behind this attack, and it may never be possible to identify them,” a spokesperson for Belgium’s cybersecurity agency said.

Walks like a duck, hacks like a duck

Still, in the wake of the attacks, many analysts had one culprit in mind: Moscow.

Along with Iran, China and North Korea, Russia is considered one of four countries that have most commonly targeted Europe with state-backed cyberattacks. But experts say the patterns and targets in this case exclude the other three.

“We strongly believe this activity could be attributed to a Russian state-sponsored threat actor,” said Xavier Bellekens, CEO of cybersecurity firm Lupovis.

He said that his company’s researchers have collected data on attacks against decoys — known in the industry as honeypots — that point towards a “state-sponsored group.” The expertise required, such as an understanding of industrial control systems and refrigeration technology, is “not trivial,” Bellekens said.

The servers the attackers used to hit the decoys were also used by Russian groups some time ago, Bellekens said. The replication of the attacks is another factor pointing towards Moscow.

Russia has ramped up its campaign of hybrid warfare in recent months, prompting EU capitals to quietly work on plans for how to respond to a major hybrid attack that could lead to deaths of European citizens — an outcome that looks increasingly likely.

The Kremlin’s hybrid playbook combines disruption of critical services with psychological pressure, all while remaining below the threshold of an all-out military attack.

The Kremlin in central Moscow is pictured on Oct. 16, 2024. | Alexander Nemenov/AFP via Getty Images

Andrea Margellati, director of Centro Studi Internazionali, an independent geopolitical think tank based in Rome, said in an interview that a cyberattack on everyday infrastructure, such as supermarket refrigeration systems, is about more than causing disruption. An adversary was choosing to reveal its ability to disable such systems. The rationale is to send a political message — that European governments are facing two fronts, one in the East and one within their own borders.

He drew a parallel with the 1962 Cuban Missile Crisis, when the Kennedy administration publicly revealed sensitive U.S. reconnaissance photographs of Soviet missiles in Cuba.

“If we don’t change the tide, we will lose,” Margellati said.

The supermarket hacks could fit a pattern of collaboration between state services and the criminal underworld that has long been observed in Russia. “As geopolitical tensions rise, I expect more of them to either collaborate with criminal groups or masquerade as criminals themselves, using ransomware and extortion as cover for state objectives,” said Joseph Rooke, a senior director at cyber intelligence firm Recorded Future.

There were numerous plausible explanations for the first round of fridge attacks in France — ranging from bored teenagers to a disgruntled former employee. But those attacks highlighted to adversarial foreign nations just how easy it is to target supermarkets, and the level of disruption and confusion it’s possible to cause.

Though many supermarket chains reported that only a small number of their stores were affected, the attacks got people’s attention — and rammed home the message that distant cyberattackers can target critical services. “Cyberattacks do not need to be designed as psychological operations to have cognitive effects,” said Charl van der Walt, head of security research at Orange Cyberdefense.

“At this scale, and also the repetition that this happened, I’m no longer very convinced that this is somebody very innocent,” said Inti De Ceukelaire, a cyber researcher.

Russia’s foreign ministry did not respond to a request for comment. Belgium’s Federal Public Prosecutor’s Office confirmed local media reports Monday that it had opened a criminal investigation into the attacks.

The counterfactuals

Experts cautioned that other potential culprits are still entirely plausible. “All options appear to be open regarding who could have done this, from state actors through to lone actors,” said James Sullivan, director of cyber at British think tank RUSI.

Multiple analysts said that while circumstantial evidence or context could point to Russia, at this stage there is simply no definitive answer.

That being said, there’s no evidence of supermarkets being held to ransom — the most common type of financially motivated criminal hack — nor have any activist groups claimed responsibility. A disgruntled employee appeared to be a fitting explanation for the first attacks in France, but would make little sense for the follow-up attacks on multiple supermarket chains. There’s also no evidence that an artificial intelligence agent has gone rogue.

That leaves few plausible explanations other than a state-backed hacker or a prankster — and the level of required expertise appears to be higher than what’s realistic for the latter, though AI now makes it easier to obtain that kind of information.

In any case, foreign adversaries will doubtless be watching and learning, said Rooke from Recorded Future. “Nation-state actors will be studying the impact and disruption,” he said.

This article was updated on Nov. 3rd to clarify that the cyberattacks had taken place over a matter of weeks.