Fridge Hacks Hit Europe as Attribution Remains Unclear

Supermarket refrigerators in several European countries have been hacked over the past few weeks, leaving retailers to discard fresh and frozen food as it thaws. The damage is clear. Responsibility isn’t. Cybersecurity authorities in the affected countries haven’t named a culprit publicly, Russia has denied involvement, and experts have raised competing possibilities.

Food Spoils, Answers Don’t

The attacks left retailers throwing away food after refrigerators failed to keep it frozen or fresh. That’s the immediate cost described in reports: food lost and stores coping with the effects of an intrusion whose source remains publicly unconfirmed. The available account gives no figure for how much food retailers discarded or how many supermarkets were affected.

French blood banks also came under attack. France’s blood collection service said the attacks didn’t affect its supplies. The distinction matters: the intrusion reached a service tied to blood collection, but the service reported no impact on its supplies. The report doesn’t explain how attackers reached the blood banks or name a specific facility.

The targets sit far from the familiar language of armies and borders. Yet people who depend on supermarkets and public services are left dealing with the consequences, while no one has resolved who acted. The facts don’t establish who carried out the hacks or whether a state directed them. They do establish that the attacks disrupted refrigeration and struck blood banks, and that official cybersecurity authorities haven’t named a perpetrator.

Claims Aren’t Attribution

Pro-Russian hacker groups claimed responsibility on Wednesday, then quickly deleted their claims, the BBC reported. Those claims belong in the record, but they don’t prove who carried out the attacks. Definitively attributing a cyberattack to a specific actor is notoriously difficult, and authorities in the affected countries haven’t publicly made that attribution.

A Kremlin spokesperson denied on Thursday that Russia was involved, calling the allegations “absurd.” Dmitry Peskov said accusations of Russian involvement were “unfounded,” according to reports in Russian media, and said such allegations were “becoming a persistent trend in European countries.” That is the Kremlin spokesperson’s denial; it doesn’t settle the question of attribution.

Some cybersecurity experts see Russia as one of the main suspects. Xavier Bellekens, CEO of cybersecurity firm Lupovis, told POLITICO that clues pointed to “a Russian state-sponsored threat actor.” Bellekens made that assessment; cybersecurity authorities haven’t publicly named a culprit. The distinction matters: a suspect, an expert’s assessment and a confirmed attribution aren’t interchangeable.

More Than One Possible Actor

A report from cyber defense firm Sekoia raises another possibility. It noted that “Iranian-aligned actors have an established record” of targeting supermarkets, including in the U.S. and Israel. That record doesn’t establish Iranian-aligned involvement in these attacks. It does show why neither the deleted claims nor Russia’s denial can settle the question by themselves.

For now, the reported effects are concrete, but public attribution isn’t. Retailers have discarded thawing food; France’s blood collection service says its supplies weren’t affected; and authorities haven’t publicly identified who was responsible. The available reporting leaves the cause open, with hacker groups’ claims, an official Russian denial and expert assessments pointing in different directions. No confirmed culprit has emerged.