Is World War III Taking Shape in Cyberspace? Europe’s Supermarket Attacks Offer a Warning

Imagine walking into a supermarket to buy groceries, only to discover that its refrigerators and freezers have stopped working. Thousands of food items are being discarded, store managers are struggling to contain the losses, and the cause is not a power failure or faulty equipment. Someone, somewhere, has remotely taken control of the cooling systems and turned them against the business.

This is not hypothetical. Across Europe, a growing wave of cyberattacks has targeted supermarket refrigeration systems, exposing how vulnerable everyday infrastructure can become when connected to the internet. What began with attacks on hundreds of supermarkets in France in October has spread to several other European countries, raising fresh concerns about the security of systems that keep essential services running.

The latest incidents, reported on November 2, affected grocery businesses in Belgium, Sweden, the Netherlands, Ireland, Luxembourg, Estonia and other European countries. Germany, Italy, Finland and additional countries have also reported incidents or disruptions.

The method was relatively simple but devastating in its consequences. Hackers reportedly gained remote access to internet-connected refrigeration controllers and manipulated their settings, switching some units into defrost or heating mode. Temperatures rose sharply, in some cases reaching about 50 degrees Celsius, leaving chilled and frozen products unsafe for consumption.

For supermarket operators, the consequences were immediate: spoiled food, financial losses, disrupted operations and the difficult task of determining whether their systems could safely be brought back online.

In Belgium, several supermarket chains reported affected outlets. Carrefour said 15 of its more than 700 stores experienced problems, while Colruyt Group reported attacks affecting five Spar stores. The furniture retailer IKEA also confirmed that refrigeration and freezer units at its Mons store had been affected.

In Sweden, grocery retailers ICA and Coop reported incidents involving some of their stores. In Ireland, food wholesaler Musgrave said 13 SuperValu outlets had been affected, forcing the removal of some chilled and frozen products from sale.

The incidents followed a similar attack in France in October, where hundreds of supermarkets reportedly experienced disruptions after hackers manipulated their cooling systems.

The scale and geographical spread of the incidents have prompted questions that go beyond the immediate financial losses: how much of Europe’s critical infrastructure is exposed to similar attacks, and what happens when hackers decide to target systems that people depend on every day?

The new battlefield is not necessarily on the ground

The phrase World War III often brings images of missiles, tanks, fighter jets and military alliances. But modern conflict increasingly involves another battlefield, one that does not always require soldiers to cross borders or weapons to be fired.

Cyber warfare has become an important dimension of national security. Governments, military institutions and private organisations rely on interconnected digital systems to manage electricity, water, transportation, communications, banking, healthcare and other essential services.

That dependence creates opportunities for attackers to cause physical disruption without directly attacking a building or deploying conventional weapons.

A compromised electricity control system could interrupt power supply. An attack on water infrastructure could interfere with treatment and distribution. Disrupting hospital networks could affect patient care, while interference with ports, railway systems or aviation infrastructure could undermine transportation and logistics.

The supermarket attacks demonstrate how this vulnerability can extend into the food supply chain.

Refrigeration may appear to be an ordinary commercial function, but it is essential to the preservation and distribution of food. When the systems fail, the consequences extend beyond a retailer’s balance sheet to suppliers, workers and consumers.

The attacks therefore offer a glimpse into how digital interference can translate into real-world disruption.

Who is behind the attacks?

Perhaps the most troubling aspect of the incidents is that authorities have yet to identify those responsible. No group has publicly claimed responsibility, and investigators have not established whether the attacks were carried out by cybercriminals, politically motivated hackers or actors working on behalf of a state.

Sweden’s National Cybersecurity Centre has acknowledged several incidents affecting grocery stores but declined to speculate about the perpetrators. Its head, John Billow, also warned about the number of operational technology devices exposed to the internet and the need for organisations to update and secure them.

Belgium’s Centre for Cybersecurity has similarly acknowledged the incidents, while federal prosecutors have opened an investigation.

The absence of an identified perpetrator makes it difficult to establish whether the attacks are connected, coordinated or part of a broader campaign.

Europe’s security concerns have also grown since Russia’s invasion of Ukraine, with governments increasingly alert to the possibility of cyber operations targeting civilian and commercial infrastructure. However, there is currently no established evidence linking the supermarket attacks to Russia or any other government.

That distinction matters. A cyberattack can be disruptive, politically motivated or even strategically significant without necessarily constituting an act of war.

What is Probable at This Time?

The growing use of internet-connected technology has transformed how businesses operate. Refrigeration systems can now be monitored and controlled remotely, allowing technicians to identify faults, adjust temperatures and manage multiple installations without visiting individual locations.

When these systems are poorly secured, inadequately updated or connected to exposed networks, they can provide an entry point for attackers. Older controllers and equipment that no longer receive security updates may be particularly vulnerable.

The supermarket incidents have raised concerns about operational technology, commonly known as OT. Unlike conventional information technology, which primarily handles data and communications, operational technology controls physical processes and equipment.

A successful intrusion into an office computer network might result in stolen information or financial fraud. An intrusion into an operational technology system can change the behaviour of machinery, interfere with production or damage physical assets.

In the European supermarket incidents, the consequences were visible in the refrigerators and freezers themselves.

Security experts have consequently urged retailers to review internet-facing equipment, install available updates, restrict remote access and disconnect vulnerable systems from public networks while investigations and security checks continue.

The challenge is that these systems are often managed by external technology providers, contractors or suppliers. A vulnerability in one service provider’s equipment can therefore affect several businesses operating across different locations.