From Nine Countries to Eleven: The Freezer Attacks Spread, and Europe Promises a Joint Response

Hackers raised the temperatures of refrigeration systems at supermarkets in Germany, Romania and the United Kingdom during Monday's cyberattacks, officials said on Tuesday, bringing the number of European countries affected in the hacking spree to at least 11. The announcements came as the European Union promised a collective response, warning that the attacks, which have spoiled tonnes of food across the continent, were "not isolated". Problems had already been reported on Monday in at least nine EU countries — Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden — and on Tuesday officials and company representatives said four supermarkets in Germany and six in Romania were affected. The UK, which is not in the EU, was also hit. The motive for the cyberattacks is unknown, and no one has claimed responsibility.

Belgium was among the hardest-hit countries on Monday, with dozens of stores across several grocery chains reporting refrigeration failures, and federal prosecutors there have opened an investigation. In Italy, about 20 supermarkets were affected; Giuseppe Spadaro, director of a group that runs Coop supermarkets in Sicily, said four of its 300 stores were hit, causing thousands of euros in damage. "We had to throw away everything. The shelves are empty," he told Italy's Corriere della Sera newspaper. Italy's government held talks with the heads of the intelligence services and the National Cybersecurity Agency on Tuesday, and Prime Minister Giorgia Meloni's office said the incident had a "limited" impact, adding: "There is no cause for alarm, although all the relevant institutional bodies remain on high alert." In Sweden, the supermarket chain Coop said refrigerators and freezers affected overnight at seven of its stores had been connected to "old 4G networks", and that the stores had since resumed normal operations. In the UK, hackers tried to target small meat-processing firms, but the impact was minimal, said Richard Horne, chief executive of the National Cyber Security Centre, who told the BBC the issue affected "the whole food supply chain" and that there had been a couple of instances where "vulnerable technology had been exploited".

The European Commission said it would assess the resilience of supermarkets against cyberattacks, and the cases would be discussed at the Commission's Security Council, according to reporting of Commissioner for Agriculture and Food Christophe Hansen's remarks. Thomas Regnier, a spokesperson for the EU, said the bloc's agencies were talking with national authorities to develop a joint response. "These are not isolated incidents, and of course, we have to be collectively resilient and prepared for such cyber incidents," he said, while refusing to point the finger at any potential culprits. Mr Hansen has described the repeated attacks as a deliberate attempt to disrupt the food supply chain and undermine consumer confidence, although no evidence publicly links the attacks to a particular actor. Romania's top cybersecurity official played down the threat of a state operation: "It seems semi-amateurish," Dan Cimpean, director of Romania's National Cyber Security Directorate, told the AFP news agency. "We do not suspect, under any circumstances, that it is a state actor." He added that no other infrastructure was compromised.

Much of the equipment involved was made by Danfoss, the Danish maker of refrigeration controls, as it had been in France. Danfoss said its products were involved in the latest attacks, that it had been in close contact with customers for the past three weeks, and that the systems should not be directly accessible from the internet. In the Dutch cases, the systems hit were not on a secure network and still used default passwords, a Danfoss spokesperson told Dutch broadcaster NOS, and in Belgium the weakness was said to lie mainly in outdated software. France's national cybersecurity agency, CERT-FR, had already warned in October that attack campaigns against Danfoss AK-SM and AK-SC controllers, as well as Copeland/Dixell XWEB systems, were probably still under way, advising operators to take devices off the internet, check defrost schedules, restore access only through a secure VPN and change default passwords. Swedish Coop said it had accelerated an upgrade, begun after the October attacks, to move its connected refrigeration equipment onto 5G networks and modern modems. A cybersecurity expert at Deloitte in The Hague, Frank Groenewegen, urged retailers to check whether their controllers were connected to the internet and running the latest security updates: "And if they don't even know, then remove them from the public internet immediately," he told Reuters.

The second wave mirrored a cyberattack that swept hundreds of supermarkets across France in October, which also affected stores in several other European countries, with about 700 victims identified by the Paris prosecutor's office. The pattern — the same kind of equipment, the same remote tampering, on the same continent, within weeks — is what has turned what might have looked like isolated faults into a European investigation. Online, the reaction was as much about the design of the systems as about the attackers: in a thread in r/worldnews on the attacks, the most-upvoted comment asked, "Why are supermarket freezers online?", with more than 1,500 upvotes, while other commenters debated whether remote monitoring could be kept without remote control: Reddit discussion, r/worldnews For operators, the advice now circulating is blunt, and it starts with disconnection. Until the physical and software changes that suppliers say are needed are made — and paid for — the simplest protection remains a secure connection for managing the fridges, which most customers adopted only after the French attack. Whether the EU's promised collective response becomes shared standards, shared threat intelligence or simply shared advice will be the test of whether an attack that spoiled food in eleven countries changes how Europe's food chain is connected.