Europe hit by fridge hacks and hoax bomb threats on flights

Supermarkets, blood banks, passenger flights and broadcasters across Europe were targeted this past week by refrigeration cyberattacks and a wave of hoax bomb threats that forced flight diversions and military escorts.^1,3,4

Authorities have not established who was behind the incidents or whether they were connected, and no explosives were found and no one was injured, but defense and security experts said disruption to everyday services can have consequences beyond immediate economic damage.^1,3,4

On Monday, supermarkets in Belgium, Luxembourg, Sweden and the Netherlands found refrigeration systems had been set to as much as 50 degrees Celsius, or 122 degrees Fahrenheit, affecting retailers including Ahold Delhaize, IKEA, Colruyt Group and Carrefour, forcing retailers to discard spoiled food. Fredrik Blix, a cybersecurity expert at Visente and associate professor at Stockholm University, said the supermarket attacks required very little technical sophistication because vulnerable refrigeration control systems were connected directly to the public internet, with some protected only by default passwords or easily guessed credentials. "These attacks, they don't really require any specific advanced knowledge to carry out," Blix said.¹

The incident followed an October cyberattack that targeted hundreds of French supermarkets, causing fires, fridges to overheat and food to spoil, and French blood-bank refrigeration systems were subsequently targeted in what appeared to be a similar incident. Blix said cyberattacks have become more common over the past decade as societies have become more digital, and he warned that publicity could encourage copycat attacks. "This is why this is so cheap to do," Blix said. "Anyone can do it, and it does not require any resources from a country or anything like that."¹

Separately, dozens of flights across Europe were targeted by fake bomb threats that led to plane searches, diversions and, in some cases, emergency landings and fighter jet escorts, though the European air traffic authority insisted that overall the threats caused minimal disruption to aviation. The threats spread beyond aviation on Friday to broadcasters, and the accounts differ on the number named: CNBC named the U.K.'s Sky News and Irish public broadcaster RTÉ, while the Monitor listed those two plus NOVA TV, a private broadcaster in Bulgaria. On Saturday, Italian Foreign Minister Antonio Tajani, who is also a vice premier, said his personal data had been disseminated on the dark web and that he has been exposed to "threats and intimidation," without specifying what information was shared but suggesting the cyberthreat was ongoing. Also Saturday, the company overseeing construction of the 55-kilometer Brenner Base Tunnel between Austria and Italy, BBT SE, said it was the target of a cyberattack last month that had no impact on operations, and last month it extended the timeline for completion by two years, to 2034.^1,3

French prosecutors have opened a probe into the bogus bomb threats targeting dozens of commercial flights, including trying to establish whether foreign powers may be involved, and those responsible have not been identified. The investigation aims to find "the authors of the emails who disseminated this false information... and to determine any potential links they may have to foreign powers," the office of the Paris prosecutor told AFP, noting that several instances concerned flights passing over French territory. Ireland's government said Friday that the hoax bomb claims sent to Irish media outlets were "likely" part of a "co-ordinated campaign of disruption" linked to the threats to airlines, and no explosives were found in any of the incidents so far.^4,3

It remains unclear who sent the airline threats or what they hoped to achieve, and authorities have not attributed the threats to any group or state actor. An email containing a threat sent Thursday to airport authorities in Rome and reviewed by The Associated Press purported to come from a group describing itself as anti-feminist and claiming it was targeting a "feminist regime," and another European airport received a threat with similar wording, though it was unclear if it came from the same sender. Some of the messages came in emails signed "fighters of the Male State," France 24 reported. In Amsterdam, the Dutch Marechaussee military police detained a man on Thursday night at Schiphol Airport in connection with a threat to a flight about to leave for Prague, Marechaussee spokesperson Doron Wallin said Saturday, adding that the Marechaussee regularly deals with fake bomb threats; it was not clear if the threat was linked to other hoaxes, the aircraft flew on to Prague later in the evening and the man was released the following day.^3,4

Matthew Borie of Osprey Flight Solutions, which advises airlines on flight threats, said he had several hypotheses ranging from a single threat triggering copycat incidents to an individual or a group making multiple threats, and "hybrid warfare" operations by state actors or their supporters. The focus on Europe means "there could be a Russian angle," said Borie, the company's co-founder and chief intelligence officer. "We need to keep in mind, though, that Iranian hybrid warfare is just as active in certain pockets of Europe as well," he said. His message for travelers was "Don't be alarmed," he said, noting that national authorities have "coordinated response mechanisms," including at times the deployment of NATO fighter jets. Jacob Funk Kirkegaard, a senior fellow at the Bruegel think tank in Brussels, said the threats were "stress-testing" how European governments and airport officials respond and whether their responses were coordinated, with an idea that "appears to be to sow chaos, uncertainty, about the reliability of air traffic across Europe" and could have "cascading effects" such as economic damage and costs related to inspection, investigation and cleaning of aircraft.³

Sidharth Kaushal, a research fellow at the Royal United Services Institute, said the incidents should be viewed within the larger context of suspected sabotage and hybrid threats across Europe, including damage to undersea cables in the Baltic Sea, death threats against European defense executives and a bomb placed on a DHL aircraft in 2024. "If this was an event in isolation, one might say 'okay, we should view it on its own merits,' but when you view it in the backdrop of all of that, it becomes less clear," Kaushal said. If Russia were responsible, such attacks could be intended to demonstrate the costs of Europe's continued support for Ukraine, Kaushal said. "I think it's more about cost imposition," Kaushal told CNBC. "Convincing the European political leadership that the costs of a war can come home to them." Russia didn't immediately respond to a CNBC request for comment, and Italian Premier Giorgia Meloni blamed pro-Russian hackers for the leak involving Tajani, while Tajani did not indicate who might be responsible but reiterated the Italian government's support for Ukraine.^1,3

European governments are contending with greater uncertainty over U.S. security guarantees after decades of underinvestment in defense, while facing unconventional threats, and hybrid warfare combines tactics such as cyberattacks, sabotage and disinformation to destabilize adversaries without triggering open military conflict. Kaushal said countries' abilities to withstand hybrid threats vary substantially, with Finland and Sweden having well-developed civilian defense programs reflecting Cold War experience while much of Europe's infrastructure was built around economic efficiency rather than defense needs. "As one goes further west in Europe, the level of preparation, both against hybrid attacks, but also just simple missile attacks of the kind that we've seen in Ukraine, is far less great," he said. "Every attack generates a bit of resilience," he said, citing NATO's increased focus on threats to underwater cables and gas pipelines after the 2022 Nord Stream sabotage.¹

Oana Popescu-Zamfir, a senior research fellow specializing in European security at RUSI, said, "We've been slow in adjusting to a new reality...We still tend to conceptually divide between peace and wartime, and that is no longer the case because we're not at war, but we're also not in peacetime." Blix acknowledged the possibility of a state or state-backed actor being behind the refrigerator attacks but said the more likely scenario is someone testing the boundaries and "having some fun."¹

Security experts were to meet in Brussels next week to discuss measures to deal with the hoaxes, with it not known whether the threats were linked, who sent them and what they hoped to achieve.³