In brief
The European Commission confirmed that supermarket refrigeration cyberattacks on Monday in Ireland, Belgium, Luxembourg, the Netherlands, Sweden, Estonia and Finland were part of a coordinated effort rather than isolated events. Commission spokesman Thomas Regnier emphasized the need for collective resilience while noting that attribution is premature and investigations are still underway.
European Commission officials declared on Tuesday that supermarket refrigeration hacks that forced retailers in Ireland, Belgium, Luxembourg, the Netherlands, Sweden, Estonia and Finland to discard food were not isolated incidents, underscoring the need for a collective response while acknowledging that attribution remains premature.
Speaking at a midday press briefing, Commission spokesperson Thomas Regnier told reporters that "the incidents highlighted how cyber‑attacks can disrupt essential services and impact citizens’ daily lives." He added that the Commission had already convened two coordination meetings on the morning of Monday’s attacks, and was in direct contact with affected member states and their national authorities.
Regnier explained that the first joint meeting assembled an EU inter‑institutional task force, Europol, and other Commission departments to share information and assess the situation. A second session later that morning included national authorities from the affected member states through the European Cyber Crisis Liaison Organisation Network. The key objective, according to Regnier, was to "understand what was happening and to determine how best to respond collectively.")
While the Commission urged caution in attributing responsibility, it left open the possibility that foreign actors may be involved. When asked if any particular nation was suspected, Regnier said,
I would be extremely careful when it comes to attributions. It’s not for us to do for now.He stressed that it was too early to make definitive claims about who was behind the attacks.
The hacks exposed the vulnerability of retail refrigeration systems, forcing stores in the affected countries to discard food products that had spoiled. Authorities in each country are conducting their own investigations, reviewing how the attackers accessed the systems, assessing the extent of the data compromised and determining how to shore up defenses against future breaches.
In response to the attacks, several European governments have called for stronger cyber‑security protocols for the grocery sector. The Commission has urged member states to bolster resilience and preparedness, noting that the incidents serve as a reminder of the fragility of critical infrastructure in the face of increasingly sophisticated cyber‑threats.
The unfolding situation remains in flux as national investigations continue and countries share updates through the European Cyber Crisis Liaison Organisation Network. The Commission will likely issue further guidance once a fuller picture of the attack vector and perpetrators emerges.
Uncertainty remains about the exact nature of the attacks, the identities of the perpetrators, and the full extent of the damage to refrigeration devices and food safety risks.
