Hackers Cranked Europe's Supermarket Fridges to 122 Degrees

Supermarkets across Belgium, Luxembourg, Sweden and the Netherlands opened Monday to find their refrigeration systems had been remotely reset to as much as 50 degrees Celsius, or 122 degrees Fahrenheit. Retailers caught in the sweep included Ahold Delhaize, IKEA, Colruyt Group and Carrefour, with spoiled food heading for the bin. It followed an October cyberattack on hundreds of French supermarkets that sparked fires, overheated fridges and ruined stock, per CNBC.

The trouble didn't stop at groceries. French blood-bank refrigeration systems were targeted in what looked like a similar strike, and a wave of suspected hoax bomb threats disrupted dozens of flights across the continent, forcing diversions and in some cases fighter jet escorts. The week closed with bomb threats against European newsrooms, including the U.K.'s Sky News and Irish public broadcaster RTÉ. Authorities have not pinned down who was behind any of it, or whether the incidents are linked.

Fredrik Blix, a cybersecurity expert at Visente and associate professor at Stockholm University, told CNBC the fridge hacks took almost no skill. The vulnerable control systems sat directly on the public internet, some guarded only by default passwords or credentials anyone could guess. That makes the attacks cheap, he said, and the publicity could spark copycats: anyone can do it, no state resources required. Blix thinks a bored opportunist testing boundaries and having some fun is more likely than a state actor.

Sidharth Kaushal, a research fellow at the Royal United Services Institute, framed the sabotage question around cost. If Russia were responsible, he told CNBC, the aim would be convincing European political leaders that the costs of war can come home to them. Russia did not immediately respond to CNBC's request for comment. Kaushal placed the incidents alongside damaged Baltic Sea undersea cables, death threats against European defense executives and a bomb placed on a DHL aircraft in 2024.

Oana Popescu-Zamfir, a RUSI senior research fellow on European security, said Europe has been slow to adjust. We still tend to conceptually divide between peace and wartime, and that is no longer the case, she said, because we're not at war but we're also not in peacetime. She warned Russia can lean on proxy networks in Europe — some directly controlled, others loosely coordinated — making blame hard to trace to the Kremlin. Attacks on internet-connected systems can do tremendous damage in concrete terms, she said, citing blood reserves, plus a psychological toll of feeling unprotected.

Preparation varies wildly by geography, according to Kaushal. Finland and Sweden built serious civilian defense programs out of Cold War experience, while infrastructure further west was designed for economic efficiency rather than defense, leaving it far less ready for hybrid attacks or even simple missile strikes. Blix's fix is basic cyber hygiene: keep industrial control systems and operational technology off the open internet. Responsibility is split between manufacturers, maintenance providers and grocery chains, and each points at the others. What worries me is that we don't really do anything, Blix said — lots of papers shuffled, lots of risk assessments, little action.