Supermarket Chain Thaw Massacre: Russia suspected in Europe’s fridge attacks

Two major cyberattacks on European supermarkets in a matter of weeks have exposed the vulnerability of the EU’s critical infrastructure. Cyber experts are raising the alarm that the attacks may be part of Russia’s ongoing hybrid warfare against Europe. Refrigerators in supermarkets in at least nine EU countries went out of service Monday, in what appears to be a repeat of cyberattacks that hit French stores on Oct. 11-12. Stores in Belgium, Luxembourg, Sweden, Germany, Ireland, the Netherlands, Estonia, Finland and Romania were among those affected, according to local news reports and spokespeople for affected supermarkets. The European Commission’s top security officials will look into the incidents, POLITICO reported Monday, with EU Agriculture and Food Commissioner Christophe Hansen describing the attacks as a “deliberate attempt to disrupt our food supply chain.” Identifying who’s responsible for a cyberattack is a tricky business, mired in uncertainty and couched in gradations of likelihood. Even once the technical work is complete, governments often hold back from formally pinning the blame for political, diplomatic or intelligence reasons. “It is not known who is behind this attack, and it may never be possible to identify them,” a spokesperson for Belgium’s cybersecurity agency said. Walks like a duck, hacks like a duck Still, in the wake of the attacks, many analysts had one culprit in mind: Moscow. Along with Iran, China and North Korea, Russia is considered one of four countries that have most commonly targeted Europe with state-backed cyberattacks. But experts say the patterns and targets in this case exclude the other three. “We strongly believe this activity could be attributed to a Russian state-sponsored threat actor,” said Xavier Bellekens, CEO of cybersecurity firm Lupovis. He said that his company’s researchers have collected data on attacks against decoys — known in the industry as honeypots — that point towards a “state-sponsored group.” The expertise required, such as an understanding of industrial control systems and refrigeration technology, is “not trivial,” Bellekens said. The servers the attackers used to hit the decoys were also used by Russian groups some time ago, Bellekens said. The replication of the attacks is another factor pointing towards Moscow. Russia has ramped up its campaign of hybrid warfare in recent months, prompting EU capitals to quietly work on plans for how to respond to a major hybrid attack that could lead to deaths of European citizens — an outcome that looks increasingly likely. The Kremlin’s hybrid playbook combines disruption of critical services with psychological pressure, all while remaining below the threshold of an all-out military attack. The Kremlin in central Moscow is pictured on Oct. 16, 2024. | Alexander Nemenov/AFP via Getty Images Andrea Margellati, director of Centro Studi Internazionali, an independent geopolitical think tank based in Rome, said in an interview that a cyberattack on everyday infrastructure, such as supermarket refrigeration systems, is about more than causing disruption. An adversary was choosing to reveal its ability to disable such systems. The rationale is to send a political message — that European governments are facing two fronts, one in the East and one within their own borders. He drew a parallel with the 1962 Cuban Missile Crisis, when the Kennedy administration publicly revealed sensitive U.S. reconnaissance photographs of Soviet missiles in Cuba. “If we don’t change the tide, we will lose,” Margellati said. The supermarket hacks could fit a pattern of collaboration between state services and the criminal underworld that has long been observed in Russia. “As geopolitical tensions rise, I expect more of them to either collaborate with criminal groups or masquerade as criminals themselves, using ransomware and extortion as cover for state objectives,” said Joseph Rooke, a senior director at cyber intelligence firm Recorded Futur