Hackers Target European Supermarket Fridges and Passenger Flights in Wave of Hybrid Threats

A series of cyberattacks, hoax bomb threats, and suspected acts of sabotage struck Europe last week, raising fresh questions about the continent's ability to defend civilian infrastructure against modern security threats.

Hackers remotely manipulated refrigeration systems at supermarkets across Belgium, Luxembourg, Sweden, and the Netherlands, forcing temperatures as high as 50 degrees Celsius — 122 degrees Fahrenheit — and compelling retailers to discard spoiled food. Affected companies included Ahold Delhaize, IKEA, Colruyt Group, and Carrefour.

The supermarket incidents followed an October cyberattack that targeted hundreds of French supermarkets, causing fires, overheated refrigeration units, and widespread food spoilage. French blood-bank refrigeration systems were subsequently hit in what appeared to be a similar operation.

Separately, a wave of suspected hoax bomb threats disrupted dozens of passenger flights across the continent, triggering diversions and, in some cases, fighter jet escorts. The week ended with bomb threats directed at European news outlets, including the United Kingdom's Sky News and Irish public broadcaster RTÉ.

Authorities have not established who was behind the attacks or whether they were connected. Russia denied involvement. "These are stupid accusations. They are baseless," Kremlin spokesperson Dmitry Peskov said in emailed comments.

Fredrik Blix, a cybersecurity expert at Visente and associate professor at Stockholm University, told CNBC that the supermarket attacks required minimal technical sophistication. Vulnerable refrigeration control systems were connected directly to the public internet, and some were protected only by default or easily guessed passwords.

"These attacks, they don't really require any specific advanced knowledge to carry out," Blix said. "This is why this is so cheap to do." He warned that the publicity surrounding the incidents could encourage copycat behavior, adding: "Anyone can do it, and it does not require any resources from a country or anything like that."

Sidharth Kaushal, a research fellow at the Royal United Services Institute, said the incidents should be understood alongside a broader pattern of suspected hybrid threats, including damage to undersea cables in the Baltic Sea and a bomb placed on a DHL aircraft in 2024. If Russia were responsible, he said, such attacks could be intended to demonstrate that the costs of Europe's support for Ukraine can reach the continent itself.

"I think it's more about cost imposition," Kaushal told CNBC. "Convincing the European political leadership that the costs of a war can come home to them."

Oana Popescu-Zamfir, a senior research fellow specializing in European security at RUSI, said the incidents revealed how slowly Europe has adapted to a changed threat environment. "We've been slow in adjusting to a new reality," she said. "We still tend to conceptually divide between peace and wartime, and that is no longer the case because we're not at war, but we're also not in peacetime."

Kaushal noted that defensive capacity varies sharply across the continent. Finland and Sweden, drawing on Cold War experience, have well-developed civilian defense programs, while much of western European infrastructure was designed around economic efficiency rather than resilience. "As one goes further west in Europe, the level of preparation, both against hybrid attacks, but also just simple missile attacks of the kind that we've seen in Ukraine, is far less great," he said.

With European governments already contending with uncertainty over long-term U.S. security guarantees and rising defense spending pressures, the latest incidents are likely to accelerate debates over critical infrastructure protection — and how quickly the continent can close the gaps that adversaries, state-backed or otherwise, appear willing to exploit.