Fridges set to 122 degrees in European retail cyberattack

On Monday, hackers remotely manipulated refrigeration systems at supermarkets in Belgium, Luxembourg, Sweden, and the Netherlands, setting units to as high as 50 degrees Celsius, or 122 degrees Fahrenheit. The disruption affected major retailers including Ahold Delhaize, IKEA, Colruyt Group, and Carrefour, forcing many to discard spoiled inventory.

The incident followed a similar cyberattack in October that targeted hundreds of French supermarkets, causing fires and equipment overheating. French blood-bank refrigeration systems were also targeted in subsequent attacks. These events exposed vulnerabilities in everyday infrastructure that is connected to the public internet.

Fredrik Blix, a cybersecurity expert at Visente and associate professor at Stockholm University, stated that the attacks required little technical sophistication. He noted that vulnerable refrigeration control systems were often protected only by default passwords or easily guessed credentials. Blix warned that the low barrier to entry could encourage copycat attacks by actors who do not require state-level resources.

Sidharth Kaushal, a research fellow at the Royal United Services Institute, suggested that if Russia was responsible, the goal was likely to impose costs on European political leadership. He argued that such actions demonstrate that the costs of war can reach domestic infrastructure. Russia did not immediately respond to a request for comment regarding the attacks.

The incidents coincide with a broader wave of disruptions across Europe, including suspected hoax bomb threats that forced the diversion of dozens of passenger flights. Bomb threats also targeted media organizations, including Sky News and RTÉ. These events occur against a backdrop of heightened geopolitical tensions and domestic unrest in countries such as France, Spain, Germany, and Italy.

Oana Popescu-Zamfir, a senior research fellow at RUSI, said Europe has lagged in preparing for hybrid threats that combine cyberattacks, sabotage, and disinformation. She noted that while the damage to internet-connected systems can be severe, the tactics are not technically complex for hostile actors to execute. She emphasized that the psychological impact on societies feeling unprotected is a key objective of such operations.

Blix stated that companies can reduce their exposure by implementing basic cyber hygiene, specifically by preventing industrial control systems from being connected directly to the internet without proper security measures. He criticized the current approach as involving too much risk assessment and paperwork without taking meaningful action to secure operational technology.