An unprecedented wave of incidents affecting the security of Europeans causes terror...
Cyberattacks on major supermarket chains tampering with refrigeration systems, bomb threats targeting passenger aircraft, and hijack alarms... are tending to become a daily reality.
From France and Belgium to Sweden, Ireland, Estonia, and Finland, hackers managed to gain access to control systems of refrigerators and freezers, driving temperatures up even to 50 degrees Celsius, resulting in food destruction.
At the same time, European airports face consecutive alerts over explosive devices on aircraft, emergency landings, flight diversions, and mobilizations of fighter aircraft.
These are incidents that, although manifesting in different countries, in some cases occur within... minutes of each other.
The likelihood of a broader hybrid war is now at the center of the debate on European security, although so far there is no evidence that all incidents are linked to each other or originate from a common coordinator.
Refrigerators turn into... ovens
The latest incident causing alarm in the European retail market was recorded on November 2, when cyberattacks struck refrigeration systems in supermarkets across several European countries.
The attacks resulted in temperatures inside refrigerators and freezers surging abruptly, with some units reaching even 50 degrees Celsius. In several instances, businesses were forced to withdraw or dispose of large quantities of food, as the products had become unfit for consumption.
Major retail groups found themselves targeted, with the incident taking on pan-European dimensions.
In Belgium and Luxembourg, dozens of stores belonging to Delhaize, owned by the Dutch group Ahold Delhaize, experienced malfunctions in their refrigeration systems. The company confirmed that an incident occurred in dozens of stores on Monday, necessitating the disposal of food. Subsequently, the situation was rectified and stores returned to normal operation.
Concurrently, the Colruyt group confirmed that five Spar stores in Belgium were targeted, while the French firm Carrefour announced that 15 of its stores in the country were affected.
Correspondingly, Intermarché disclosed that 15 of its total 153 stores in Belgium encountered problems. A spokesperson noted that security measures allowed for the rapid containment of the attack in most cases, though certain stores suffered inventory losses.
The company pointed out, in fact, that the greater extent of the new attack appeared to concern other major market players, primarily Carrefour and Delhaize.
Even IKEA confirmed a cyberattack incident at its store in Mons, Belgium, where refrigerators and freezers were impacted from Sunday through Monday. The store remained open, but the company initiated inspections of devices, products, and facilities across its other locations in the country as well.
The issue, however, was not confined to Belgium.
In Sweden, ICA, the largest supermarket chain in the country, confirmed an incident in a limited number of stores operating on networks outside the central systems of the company. Problems were also reported at Coop.
In Finland, the chain Kesko experienced disruptions in its cooling systems, while in Ireland Musgrave, owner of SuperValu, announced that 13 stores were affected. In Estonia, issues were registered at the chain Selver.
The scale of the attack is reflected in the fact that more than 100 stores and businesses in various European countries were affected, while issues were also reported in smaller enterprises, such as butcher shops and grocery stores.
The case generates particular concern because it does not merely involve a corporate data breach or the temporary disruption of an online service. The attackers succeeded in interfering with systems controlling the physical operation of equipment, causing real damage to merchandise and businesses.
France had preceded
The incident of November 2 does not constitute an isolated development. Approximately three weeks earlier, France had confronted a large-scale cyberattack on supermarket chains. Specifically, on October 12, hackers managed to remotely manipulate the refrigeration systems of hundreds of stores, driving temperatures in some cases up to 50 degrees Celsius.
The result was the destruction of vast quantities of food, while in several stores fires even broke out, according to reports by French authorities.
The Paris prosecutor's office characterized the attack as large-scale, noting that connected refrigerators of major food enterprises were impacted.
The group Les Mousquetaires, owner of Intermarché, reported that roughly 150 of its stores were hit, with refrigerators remaining at exceptionally high temperatures for around six hours. The company estimated that financial damages would reach several million euros.
The French government mobilized relevant cybersecurity agencies, while the National Cybersecurity Agency of France (ANSSI) assumed the investigation of the case.
The vulnerable point:
The most alarming aspect of the cyberattacks is that, according to experts, highly sophisticated techniques were not required to inflict such extensive damage.
Fredrik Blix, strategic cybersecurity advisor at Visente AB, argued that the refrigerator control systems were connected directly to the public internet. As he explained, this specific equipment featured built-in remote access capabilities, while there was information regarding passwords that could be identified by third parties. He revealed that the manufacturer had released a security patch in August, yet thousands of devices had not been updated. Even worse, certain older models could no longer accept necessary updates.
Blix pointed out that following the attack in France, relevant cybersecurity agencies had warned European entities to disconnect these specific devices from the internet.
The question he posed to suppliers and firms that install and remotely manage such equipment is what exactly they did during the three weeks intervening until the new attack. He also highlighted the fact that so far there has been no claim of responsibility from any known cybercrime group.
In his assessment, the lack of claimed responsibility generates different possibilities: either these attacks are carried out simply because vulnerable devices are easily accessible, or they represent actions with a broader political objective, such as creating insecurity in countries supporting Ukraine.
This constitutes the hypothesis of the expert and not a conclusion of the investigative authorities. However, it underlines the geopolitical dimension that even a seemingly simple cyberattack can acquire.
From supermarkets to American military bases
The case acquires even greater interest when considering that corresponding incidents were also recorded at facilities of the US military.
In late August, freezers in catering areas of six American military bases exhibited malfunctions, resulting in large quantities of food thawing and being ruined. In one instance, refrigerator temperatures increased overnight, spoiling food supplies by the following morning.
The Pentagon is treating the incidents as a potential cyberattack and, according to sources cited by Reuters, is coordinating its investigations with French authorities.
A connection between the incidents at the military installations and the attacks on European supermarkets has not been proven. However, the similarity in how cooling systems are affected raises reasonable questions regarding the security of this specific technological equipment.
Concern is no longer confined to loss of commercial inventory. It touches upon the vulnerability of systems supporting supply lines for military facilities and the daily operation of hundreds of enterprises.
Alarm at airports as well
Concurrently, a second front of concern is taking shape in European air transport.
During October, incidents involving threats, alarms, and emergency security procedures on passenger aircraft were recorded, with some cases even leading to the mobilization of fighter jets.
On October 13, a Corendon Airlines flight from Corfu to Nuremberg triggered an alert among European security authorities when the cockpit squawked transponder code 7500, which indicates a hijacking.
Simultaneously, communication with the crew was temporarily lost, prompting the activation of prescribed procedures for responding to a potential aircraft hijacking.
The mobilization expanded beyond Greek borders, with relevant authorities sounding alarms and taking measures for the safe landing of the aircraft in Germany.
The plane landed normally in Nuremberg and passengers faced no danger. Corendon Airlines attributed the incident to a radio communication system malfunction.
The airport of Nuremberg temporarily suspended operations until necessary protocols were completed.
The incident carries particular significance, as it demonstrates how quickly a false distress signal can trigger security mechanisms across more than one European country.
A few days later, on October 18, an Austrian Airlines aircraft operating flight OS82 from Tel Aviv to Vienna was forced to divert and land in Sofia, Bulgaria, following a bomb threat. The Airbus A320 carried 51 passengers and six crew members. While near the border of Romania, the crew was notified of the threat and decided to make an emergency landing. The Bulgarian Air Force scrambled a MiG-29 fighter, which escorted the passenger jet until its landing at the airport of Sofia. Passengers disembarked and exhaustive security checks were conducted. No explosive device was located and the flight subsequently continued to Vienna.
This specific incident illustrated once more how a threat, even when ultimately unconfirmed, can lead to the mobilization of military and police forces and significant disruption in air transit.
New wave of threats in November
The situation became even more alarming on November 2 and November 3, when successive reports of suspicious messages and bomb threats sparked emergency mobilizations at European airports.
On Monday, November 2, a Wizz Air flight from London bound for Sofia was forced to make an emergency landing in Budapest following a bomb threat. The aircraft was escorted by a Hungarian fighter jet, while following the landing prescribed checks were carried out. The airline announced that nothing suspicious was found.
On Tuesday, November 3, four more passenger planes faced threats regarding explosive devices.
1. A LOT flight from London Heathrow to Warsaw made an unscheduled landing at Modlin airport, instead of its original destination airport, Warsaw-Chopin. The aircraft was moved to an isolated area, while authorities carried out inspections. Modlin airport temporarily closed and subsequently resumed operations.
2. A SAS flight from Copenhagen to Warsaw landed normally at Chopin, where passengers were evacuated and the aircraft was inspected. Polish authorities reported that the threat was not confirmed.
3. In Spain, a Ryanair aircraft operating the Manchester, Murcia route also faced a bomb threat. On board were 121 individuals, including crew, while Spanish authorities activated emergency protocols and mobilized the fire service.
4. On the same day, an alarm was raised in Sofia when an aircraft arriving from Israel received a bomb threat via electronic mail. Counter-terrorism units took over inspection of the aircraft, while authorities investigated the content and origin of the message.
So far, it has not been clarified whether these specific threats are interconnected or constitute isolated events.
The fact, however, that within roughly 48 hours so many alerts occurred on flights connecting the United Kingdom, Denmark, Poland, Spain, Bulgaria, and Israel has prompted serious concern.
The role of artificial intelligence
An additional element complicating the landscape is the increasing utilization of artificial intelligence by criminal networks and other malicious actors.
Bjorn R. Watne, Chief Information Security Officer of Interpol globally, has warned that artificial intelligence increases the scale and intensity of cyberattacks, enabling the simultaneous targeting of multiple victims. As he explained in an interview with CNBC, this is not necessarily a revolution in how attacks are executed, but an evolution amplifying existing capabilities of threat actors. This means that an attack previously demanding significant time and specialized resources can now be deployed more easily across more systems and organizations.
The problem becomes even greater when attacks target devices connected to the physical operations of an enterprise, such as cooling systems, storage facilities, and management networks.
www.bankingnews.gr
Σχόλια αναγνωστών