Two waves of attacks on supermarket refrigeration in under a month have turned a strange retail incident into a question for European security officials: who is doing this, and will anyone ever say so officially? On Monday, November 2, 2026, refrigerators and freezers in stores across at least nine EU countries stopped working properly, according to local news reports and supermarket spokespeople collected by Politico. Belgium, Luxembourg, Sweden, Germany, Ireland, the Netherlands, Estonia, Finland and Romania were among those affected. Retailers reported temperatures pushed as high as 50 degrees Celsius and food thrown away.
The European Commission says it will look at the incidents. Belgian prosecutors have opened a criminal case. A number of security analysts are pointing at Moscow. Nobody with authority to attribute the attacks has done so, and Belgium’s national cybersecurity agency has warned that it may never be possible to identify those responsible.
The store-level details of the November 2 wave are covered in our earlier report on the supermarket freezer cyberattacks. This piece looks at what the EU is actually doing, what the evidence on state involvement does and does not show, and why the answer matters to companies far outside the grocery trade.
What “investigation” means here
Early coverage described an EU investigation. The reality is more specific. EU Agriculture and Food Commissioner Christophe Hansen told Politico that the attacks would be discussed at the next meeting of the Commission’s Security College, a format chaired by President Ursula von der Leyen and attended by all commissioners, which she set up in March 2025 to examine threats to the EU’s internal and external security. The aim, Hansen said, is to assess retailers’ contingency plans and their ability to respond. As of Politico’s November 2 report, no date had been set for that meeting.
That is a policy review, not a criminal or forensic inquiry. Criminal investigation remains national. Belgium’s Federal Public Prosecutor’s Office confirmed it had opened one into Monday’s attacks, and the Paris prosecutor’s office told Recorded Future News that the October attack on French supermarkets had around 700 victims. Hansen described the attacks as “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it,” while stressing that Europe’s food security itself is not at risk.
The case for, and against, a state actor
The argument for Russian involvement, as experts quoted by Politico set it out, rests on several circumstantial points:
- Infrastructure overlap. Xavier Bellekens, chief executive of the security firm Lupovis, said his company’s decoy systems recorded attacks from servers that had previously been used by Russian groups, and that the pattern pointed to a “state-sponsored group.”
- Skill and replication. Bellekens said the knowledge of industrial control systems and refrigeration equipment involved is “not trivial,” and that the repetition of the attack across countries is itself a signal.
- Motive by elimination. Analysts noted that no ransom demands have surfaced and no activist group has claimed responsibility. A disgruntled insider was a plausible theory for the first French wave but fits poorly with coordinated attacks on several chains in several countries.
- Context. Russia is one of four states most often linked to state-backed cyberattacks on Europe, and EU capitals have been preparing for an escalation of hybrid attacks.
Joseph Rooke, a senior director at the threat intelligence firm Recorded Future, told Politico that the attacks could fit a long-observed pattern of cooperation between Russian state services and criminal groups. “As geopolitical tensions rise, I expect more of them to either collaborate with criminal groups or masquerade as criminals themselves, using ransomware and extortion as cover for state objectives,” he said. He added that “nation-state actors will be studying the impact and disruption” regardless of who carried out the attacks.
The counterweight is just as important. James Sullivan, director of cyber at the UK think tank RUSI, said “all options appear to be open,” from state actors to lone individuals. Several analysts told Politico that the evidence is circumstantial and there is no definitive answer. Server reuse can be deliberate misdirection, and honeypot data shows who probed a decoy, not necessarily who disabled a freezer in Brussels. Russia’s foreign ministry did not respond to Politico’s request for comment. At this stage, Russian involvement is a hypothesis held by some experts, not a finding by any government.
How attribution would actually happen
Technical analysis is only the first step. In the EU, formal attribution is a political act by member states, which can then use the bloc’s cyber diplomacy toolbox. That includes joint statements, the cyber sanctions regime created in 2019 and the framework adopted in October 2024 for sanctions over Russia’s destabilizing activities, including hybrid threats. Governments often wait months or years before naming a state, and sometimes never do, for diplomatic or intelligence reasons. Businesses planning their response should not wait for that answer.
Why the weak point is the same everywhere
Whoever is responsible, the attack path is mundane. Reporting on both waves points to internet-exposed remote controllers for refrigeration systems. In France, the national cybersecurity agency ANSSI said attacks affected controllers made by several brands. In the November wave, an Estonian contractor said attackers reached an older Danfoss system, Dutch broadcaster NOS reported Copeland equipment was targeted in Belgium, and both manufacturers have said affected devices were mainly discontinued products that no longer receive security updates. The chief executive of Belgian installer Sabcobel said some units needed physical modifications, not just a software fix.
That combination of legacy equipment, remote access and an outside service company managing the kit is common in buildings, hospitals, warehouses and data centers, not just supermarkets. It is the same pattern behind a wave of IoT attacks in other sectors, and it is often invisible to the teams that manage third-party relationships, because the maintenance contract sits with facilities rather than IT or procurement.
EU law only partly reaches it. The Cyber Resilience Act’s reporting obligations for actively exploited vulnerabilities began applying on September 11, 2026, and its core security and support-period requirements for connected products apply from December 11, 2027. Neither forces manufacturers to patch devices already out of support. NIS2 lists food as an “other critical” sector, but its scope covers food businesses engaged in wholesale distribution and industrial production and processing, so coverage of retail operations depends on how each group is structured and how each member state has transposed the directive. Mapping how these overlapping EU regimes apply to your entity is the starting point for operationalizing EU cybersecurity compliance.
Is this a data protection issue?
Usually not directly. A refrigeration controller typically holds temperatures and settings, not personal data, so a defrost attack alone is unlikely to be a personal data breach under the GDPR. The picture changes if attackers used stolen technician credentials, reached store networks that also carry loyalty, payroll or CCTV systems, or pivoted through a service provider’s remote access platform into other clients. In that case the 72-hour notification clock under Article 33 may start when the controller becomes aware of a breach involving personal data. Incident teams should check rather than assume.
What operators should do while attribution remains open
- Find every remotely managed controller. Include refrigeration, HVAC, building management and access control, and record who maintains each one and how they connect.
- Close direct internet exposure. Put remote access behind VPN or a managed gateway with multi-factor authentication and remove default or shared credentials.
- Plan for unsupported devices. Ask vendors which models are end of service and budget replacement, since no current EU rule requires a fix.
- Write an operational technology incident playbook. Cover manual overrides, stock disposal records for insurers, and when to notify national CSIRTs, police and, if personal data is involved, data protection authorities.
- Review service contracts. Require service providers to report incidents to you promptly and to disclose which other customers share the same remote access tools.
Frequently asked questions
Has the EU blamed Russia for the supermarket attacks?
No. As of November 4, 2026, no EU institution or member state government has formally attributed the attacks. Some private security experts believe a Russian state-sponsored actor is likely, while others say all options remain open.
Is the European Commission running a criminal investigation?
No. The Commission plans to discuss the attacks at its Security College to assess retailers’ preparedness. Criminal investigations are being handled nationally, including by Belgium’s federal prosecutor and, for the October attacks, the Paris prosecutor’s office.
Were the attacks ransomware?
There is no public evidence of ransom demands so far. That absence is one reason analysts doubt a purely financial motive.
Does the Cyber Resilience Act cover refrigeration controllers?
Connected controllers are products with digital elements within the CRA’s scope. Its main security and support obligations apply from December 11, 2027 and do not require updates for devices already discontinued.
A warning heard well beyond the frozen aisle
If the attacks were a state operation, they were a cheap demonstration that an adversary can reach into thousands of ordinary businesses through equipment nobody thought of as critical. If they were not, they showed others how easily it could be done. Either way, Rooke’s warning that nation-state actors are “studying the impact” applies to every company that has quietly connected an old controller to the internet and handed the password to a contractor. The Security College will decide what Brussels asks of retailers. Whether the next cold night goes better depends on what each operator does before then.
