By Oleksandr Levchenko
Russian-linked hacking groups are likely to be involved in a series of cyberattacks targeting refrigeration equipment in supermarkets across several European countries. These operations demonstrate the expansion of Moscow’s hybrid warfare toolkit against the West, particularly its use of vulnerabilities in civilian commercial infrastructure to inflict economic and social damage.
According to media reports, the attacks on supermarket refrigeration systems involved IT infrastructure previously associated with Russian hacking activities. To investigate the incidents, British cybersecurity company Lupovis deployed specialised online honeypots that attackers could not distinguish from genuine controllers used in Danfoss refrigeration equipment.
Between 20 and 30 October, Lupovis specialists recorded 256 attempted attacks originating from 91 sources. According to the company’s CEO, Xavier Bellekens, the hackers used infrastructure previously associated with Russian cyber operations.
Two major waves of attacks targeting refrigeration equipment in European supermarkets took place overnight on 11–12 October in France and on the night of 1–2 November in nine other European countries. The attackers switched refrigeration units into defrost mode, causing temperatures inside cold-storage chambers to rise and food products to become unfit for consumption.
During the first wave of attacks, approximately 700 French supermarkets were affected, including outlets belonging to the Intermarché, Carrefour, Coopérative U and Monoprix chains. In some stores, the value of spoiled products was estimated at tens of thousands of euros, while the combined losses incurred by retail chains amounted to tens of millions of euros.
The second wave affected more than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden. Similar incidents were also reported in Finland, Italy and Portugal. However, financial losses during the November wave were significantly lower than those recorded in October.
The involvement of cyber groups linked to Russia in attacks on refrigeration systems at European supermarkets indicates an expansion of the range of Moscow’s hybrid operations against European countries. These activities now extend beyond information campaigns, cyber espionage and sabotage to include interference with civilian infrastructure essential to the everyday functioning of European societies.
Of particular concern is the vulnerability of networked control systems used in industrial and commercial equipment. The supermarket incidents demonstrate that even relatively simple operating systems responsible for managing refrigeration units can be exploited to conduct targeted cyberattacks. Similar vulnerabilities could potentially be exploited in other economic sectors, including energy, transport, logistics and municipal services.
Consequently, attacks on refrigeration equipment can be viewed not merely as isolated incidents intended to cause economic damage, but also as tests of the ability to disrupt civilian infrastructure in European countries. The vulnerabilities identified create opportunities for similar methods to be employed against facilities whose disruption could have far more serious consequences for society and the economy.
The psychological impact of such operations is another important consideration. Interference with refrigeration systems and the large-scale spoilage of food directly affect consumers, retail chains and suppliers. Repeated incidents of this kind could heighten public perceptions of vulnerability and undermine confidence in governments’ ability to ensure the uninterrupted functioning of civilian infrastructure. Creating an atmosphere of uncertainty and distrust may be one of the indirect effects of hybrid operations aimed at weakening the resilience of European societies.
The economic consequences of these attacks could also extend far beyond the immediate losses incurred by retail chains. Spoiled goods, equipment restoration costs and additional cybersecurity measures place a financial burden on businesses. If such incidents become systematic, their impact could spread to food producers, suppliers and logistics companies, increasing risks to the stability of the EU internal market.
The potential impact of such operations on food security represents a separate concern. Large-scale disruption of refrigeration systems could result in substantial food losses, complicate storage operations and place additional pressure on supply chains. If these attacks become systematic, European countries will have to treat the cybersecurity of retail and logistics infrastructure as an integral part of their broader food security policies.
The further spread of such threats will force European governments and the private sector to allocate additional financial, technical and organisational resources to protecting civilian infrastructure. This will increase the overall cost of ensuring economic security and require a reassessment of cybersecurity priorities. Amid Russia’s aggression against Ukraine and growing threats to European security, these additional expenditures could make it more difficult to allocate resources between protecting civilian infrastructure, strengthening NATO’s defence capabilities and continuing military and financial assistance to Kyiv.
Oleksandr Levchenko is a Ukrainian diplomat, independent analyst and professor at the State Tax University in Ukraine. He served as Ukraine’s ambassador to Croatia and Bosnia and Herzegovina (2010–2017) and as a consul in the Federal Republic of Yugoslavia (1993–1997). During the war, he has written some 5,000 articles on Russia’s aggression against Ukraine for online media outlets in nine countries.
Written for CIVIL Today.
CIVIL. 27 years defending democracy and human rights.
Now we need your support to continue.
SUPPORT CIVIL — MAKE A CONTRIBUTION
