Supermarket refrigerators and freezers in at least six European countries and two US military bases have been remotely commandeered by unknown hackers who raised unit temperatures — in some cases to 50°C — destroying food stocks, melting components, and in some instances causing fires. The attacks, which began in October with hundreds of French supermarkets, escalated on Monday to hit Belgium, Luxembourg, Sweden, and Ireland simultaneously. No group has claimed responsibility, and Belgium's prosecutor's office has opened a criminal investigation. The attack vector is depressingly straightforward. Supermarket refrigeration systems are internet-connected for remote management, often by third-party operators. University of Bristol cybersecurity professor Awais Rashid told Al Jazeera that many controllers are past their end of life, carry known vulnerabilities, and use easily guessable passwords. These are not zero-day exploits requiring state-level sophistication — they are unlocked doors that nobody bothered to close. The footprint is wide and growing. Delhaize, Carrefour, Colruyt/Spar, Swedish Coop, IKEA, De Laet & Van Haver, and Ireland's Musgrave/SuperValu all confirmed incidents on Monday alone. The Belgian butchery chain De Laet & Van Haver reported fridges spiking to 18°C, destroying €15,000 worth of meat at a single store. France's October wave cost millions of euros across hundreds of locations. In the US, Pentagon investigators are communicating with French authorities after freezers at Fort Huachuca and Naval Station Newport were forced into defrost mode in August. European Commissioner for Agriculture Christophe Hansen called the attacks a "deliberate attempt to disrupt" EU food supply and undermine consumer confidence, while noting that food security "is not currently at risk." That distinction matters: this is disruption-grade, not starvation-grade. The damage is economic and psychological — spoiled inventory, business losses, and the slow erosion of trust in infrastructure people use daily without thinking about it. The attribution vacuum is doing heavy lifting for speculation. European intelligence officials have warned of escalating Russian shadow warfare across the continent, and the UK's National Cyber Security Centre issued a separate warning that AI-powered cyberattacks on critical infrastructure are "highly likely" by 2028. North Korea was recently accused of a $6.3 billion Binance cryptocurrency heist. But no evidence has been presented linking any state actor to the refrigerator attacks specifically, and the low sophistication of the attack vector — default passwords on end-of-life hardware — means the perpetrator pool is essentially unlimited. The structural lesson is more important than the whodunit. Europe's food retail infrastructure digitized its cold chain without securing it. Refrigeration controllers were connected to the open internet, managed by third parties with no apparent patching schedule, and left with factory-default credentials. This is not a vulnerability discovered by advanced persistent threat actors — it is a standing invitation. The UK's "Be Ready" campaign, urging citizens to stockpile three days of tinned food and bottled water, is a tacit admission that the infrastructure cannot be defended faster than it can be attacked. Rashid's closing point deserves emphasis: most digital infrastructure works safely every day because good security practices enable that. The refrigeration attacks are not a story about the fragility of all connected systems — they are a story about what happens to the specific systems where good practices were never applied. The fix is boring: patch controllers, segment networks, change passwords. The question is whether the economic incentives of food retail — thin margins, outsourced IT, cost-minimized maintenance — will permit that fix before the next wave hits.
