The cyberattack last week that hit hundreds of French supermarket refrigerators had Europeans wondering if the nonstop warnings about AI risks had finally landed in the real world.

They hadn’t — at least, not yet.

Experts say the attack, which forced hundreds of retailers to throw away defrosted food and spoiled milk, was mostly a reminder of the importance of old-school cybersecurity in safeguarding essential goods and services.

The attack is a “typical example” of how “low-key cyber-enabled sabotage can affect very crucial supply for society,” said Ferdinand Gehringer, hybrid threats lead at FTI Consulting. 

It’s arguably the most consequential hack in the European Union this year, with tangible, disruptive real-world repercussions. France’s Prime Minister Sébastien Lecornu personally managed the fallout, which prompted coordination and information-sharing at the EU level. 

The perpetrators, whose identity and motives are currently unknown, hacked into digital systems to remotely raise the temperature of refrigerators in supermarkets including Intermarché and Carrefour.

One cybersecurity expert working with Lecornu’s office said the French government held meetings after the attack to try to map all the potentially affected sectors, beyond supermarkets. “We’re in the middle of the flu vaccination campaign,” he said, referring to vaccine storage, which also relies on temperature control solutions, though no such attacks have been registered.

To add to the fear and confusion, supermarkets in the Netherlands and Belgium experienced unrelated cyber incidents that same week. Though there was limited impact in those cases, they were a good example of “how big our reliance is in the food supply chain on IT and network systems,” Dutch food security minister Silvio Erkens told POLITICO. 

The attacks come after citizens and policymakers have spent months being bombarded with warnings about scenarios in which unpredictable advanced artificial intelligence models escape human control.

While most good and bad actors on the internet are increasingly using AI models to increase speed and capacity, cyber experts say the hackers in question in the French case most likely used traditional methods to take advantage of devices needlessly exposed to the internet.

Connecting devices to the internet in this way is “an old-fashioned bad practice,” said Amir Preminger, chief technology officer at Claroty, a cybersecurity company that identified a software flaw in a product made by Danfoss, one of the refrigeration companies targeted by the French hacks. Danfoss fixed that flaw in 2025. 

Food systems

The attacks come at a time when Europe’s food security is already under considerable pressure due to geopolitical insecurity and climate change. The continuing disruptions in the Strait of Hormuz are pushing up fuel and fertilizer prices at a time where farmers struggle with the fallout of extreme drought that caused lower yields in many parts of Europe. These problems are compounded by the blockade of the Black Sea which is fueling the rise of global food prices.

“It is very serious that cyber criminals attack our food systems,” said Else Groen, director general of trade body Independent Retail Europe. She nonetheless stressed that food supply chains are resilient, which reduces the chances that consumer food supply would be endangered — even if such attacks are already a “major blow” for retailers operating on razor-thin margins.

The incidents bring to the fore a long-running problem with so-called operational technology, meaning industrial devices with physical outputs, like refrigeration systems. Critical sectors are packed with these kinds of devices, many of which are old, poorly protected, unnecessarily connected to the Internet, or some combination of the three. They’re also obscure and sometimes forgotten, despite the ramifications if they’re tampered with.  

And last week’s problems are far from solved. French and German cyber authorities warned that attacks were probably still ongoing, and the Greek cyber agency and an industry tracker said after the attack that there were hundreds of devices still connected to the internet.

Preminger too said there are still devices exposed, though he added that the number is declining, and not all are necessarily vulnerable to attack. Another research group found that the number of exposed Danfoss devices had significantly decreased.

Finding a fix

What’s changed with the widespread diffusion of advanced AI models is that cyber attacks are now faster and easier to replicate. Claroty reproduced the original flaws in Danfoss products in 28 minutes at a cost of $6, it said. 

In broad terms, AI makes it easier to carry out many types of cyberattacks and enables attackers to pounce on software flaws more quickly. Financially motivated cybercriminals — who have already spent years extorting businesses and disrupting essential services like hospitals — can use AI to simultaneously launch attacks on multiple targets.

Though the motive for the attacks on French supermarkets remains unknown, it is notable that there was no reported attempt at extortion. The strike did come as Russia ramps up its campaign of hybrid warfare against Europe, and senior EU and European leaders have consistently warned that Moscow could use cyberattacks to disrupt real-world services. Beyond food supplies, AI-enhanced targeting could be aimed at banking, hospitals and the functioning of the internet itself.

Still, these fears of bad human actors using AI should be distinguished from the science-fiction scenarios pushed by so-called AI doomers, in which bots themselves are motivated and able on their own to wipe out humanity.

Digital security experts, including the EU’s own in-house cyber team, are also turning to AI for defense. But it’s not a silver bullet, said Rémi Enjolras, a chief technology officer at Splunk, part of Cisco. Critical industries need to stop “seeing AI as a magical tool that will solve everything and go back to the fundamentals,” he said.

The EU has passed laws intended to force critical industries and product manufacturers to get those fundamentals right. But France, for example, is lagging in implementing such national regulations, and there are few other incentives to get companies to do that difficult and costly work.

Still, the images of empty supermarket shelves could provide a new incentive. “It should serve as a kind of a wake-up call,” Enjolras said.

Émile Marzolf contributed to this report.

DUBLIN — The Irish capital, which doubles as Europe’s de facto tech capital, hosted two very different AI summits in the past week.

Most eyes were on the International AI Summit, the signature tech event of Ireland’s six-month presidency of the Council of the EU, where top brass from the world’s biggest tech firms discussed ways to harness artificial intelligence and minimize safety risks.

But the weekend before, a very different conversation was taking place at the Workers’ AI Counter Summit, as Ireland’s tech workers demanded a say in how the burgeoning technology reshapes the workplace and society.

Ireland’s lucrative tech sector has been rattled by waves of AI-driven layoffs — and the country’s fledgling tech union has seen an exponential spike in sign-ups from workers who are worried about their future.  

There’s an “awakening” happening right now among workers in Ireland’s tech sector, and a growing “awareness that they’re not bulletproof,” said Sinéad Gibney, a social democrat lawmaker who previously worked for Google.  

“I do think what we will see is that parts of roles will be automated, which means that people will be competing more heavily for the same roles,” she said. “They won’t have the same labor power and therefore we’re going to see a drop in quality of work, we’re going to see more zero-hour contracts, in more places than we already see it.”

The labor movement brewing in Ireland, where many of the world’s tech giants have their EU bases, is part of a wider trend among tech workers globally, who have seen their work disrupted by rapidly evolving AI.

Rise in layoffs

Ireland’s dedicated union for tech workers, the Digital and Techworker Alliance (DATA), has seen a five-fold increase in membership since it was first founded in 2023.  

In its first year and a half of existence, membership hovered around 270 people. In the past year-and-a-half, it’s jumped to more than 1,350 members, DATA organizer John Bohan told POLITICO.  He added that this number tends to spike around layoffs and other actions.

“The tech industry was founded on the idea that it would never have a union, because they’re making people rich, and treat them really well,” Bohan said.  “But post-Covid, workforce adjustments happened again and again, with layoffs and declining conditions in the sector. We started to see more people wanting to get organized around redundancies.”  

The spike in sign-ups coincides with a wave of layoffs in Ireland’s tech bubble (and the tech sector globally), as companies corrected pandemic-era overhiring, and diverted investment to AI.  

Ireland hosts the EU headquarters of most of the world’s largest tech companies, and more than 170,000 people are employed in the tech sector, according to the country’s statistics institute.

Social media giant Meta has roughly halved its workforce in Ireland since the pandemic, axing well over 1,000 roles to offset AI investment and boost efficiency. Separately, Meta subcontractor Covalen also announced massive layoffs earlier this year, cutting more than 700 people.  

Video-sharing platform TikTok announced this year it would shed around 300 Irish jobs, mostly from its trust and safety team, shifting the work to other countries, outsourced vendors or automated AI solutions.  

A report by the IMF earlier this year warned that Ireland’s labor market is “relatively more exposed” to AI than many advanced economies, partly due to its concentration of tech workers.  

The AI race is also creating new jobs on the Irish market – as AI firms like Anthropic and OpenAI are setting up Irish bases and trying to lure Big Tech workers with even bigger salaries.  

Amid the uncertainty and volatility of the AI boom, tech workers are turning to unions for the first time as a safety net. One tech worker who used to work in trust and safety at a big tech firm told POLITICO that there used to be a feeling that as a “pampered” tech worker you “can’t ask for your rights, because you already have it so much better.” 

But as layoffs continue and teams get leaner, workers in fields like trust and safety “now have to deal with these issues with fewer and fewer resources”, and face a “constant threat of being chopped,” the worker said.  

That’s causing an “undoing of a certain perspective that we have of ourselves as tech sector workers,” they said, “because of undeniable experiences that now put us in situations where we clearly see our rights being violated, even if we may have it so much or somewhat better than most people.” 

A different tech worker who currently works for Covalen told POLITICO that there is a sense that “if they believe they can replace you with AI, they will do that.”  

“All these Big Tech firms only care about profit, and what I have realized is the Irish government protects that Big Tech capital [rather than workers],” the Covalen worker said. “But the question is, what’s the government going to do when the tech bros change their mind and move elsewhere?”  

Workers at the center

The speaker list at this week’s AI summit was a flex of the country’s strength as a tech hub, as top names from the world’s biggest companies like Google and Microsoft took to the stage.

Fionnuala Ní Bhrógáin, head of organizing and campaigning at Ireland’s Communications Workers’ Union (DATA’s parent union), was the only union voice on the line-up.

“The fact that 36 executives and industry bosses featured on the program, compared with just one trade union speaker — invited at the last minute after attention was drawn to the absence of workers’ voices — says a lot about the value the Irish government places on AI’s impact on workers,” she told POLITICO.

“The reality is that a meaningful conversation about AI’s future can only happen through genuine engagement with workers and collective bargaining,” Ní Bhrógáin added. “Without that voice, we risk deepening mistrust and resistance rather than creating the conditions for workers to shape these changes collectively.”

DATA organized its counter-AI summit the previous weekend, to put “workers at the center of the debate about power, AI, technology and the future of work.” 

The event cut through the “hype and futurism of politicians and industry figures to focus on the real present harms faced by ordinary workers and communities,” DATA’s Bohan said.  

The union is pushing for stronger legal protections for tech workers caught up in AI-driven layoffs in Ireland, including making it mandatory for employers to recognize unions during collective bargaining. It is also calling for a ban on cooling-off clauses that prevent laid-off workers from moving between Big Tech subcontractors.  

A spokesperson for Ireland’s department for enterprise told POLITICO in a written statement that the government is “committed to strengthening collective bargaining and industrial relations” and has published an action plan to do so between now and 2030.  

They said that employers already have to comply with obligations under Irish employment law, including consultation and notification procedures for collective redundancies, and workers who feel those rules have been broken can complain to the Workplace Relations Commission. 

Firefighting to future-proofing 

Naoise Ó Cearúil, a center-right Fianna Fáil lawmaker who chairs the AI committee, pointed out that while there have been high-profile job cuts in Ireland’s tech sector, “the actual net is that there has been an increase [in jobs], particularly over the past year and even five years.” 

According to Ireland’s central statistics office, total employment in tech and related sectors surpassed 177,000 in the second quarter of this year, up from around 144,000 at the same time in 2021.  

Ó Cearúil pointed out that many job losses were in trust and safety jobs like content moderation that are “very difficult mentally,” and now tech firms are able to “utilize AI and software to be able to do a lot of detection, rather than using humans.”  

He has called for a national program to be established, to support workers whose jobs are at risk due to AI and automation.  

A spokesperson for Ireland’s department of enterprise acknowledged that the country’s tech sector has “experienced significant adjustment in recent years,” but said the changes were generally part of wider global restructuring “rather than reflecting any Ireland-specific weakness.” 

They said the Irish government is currently focused on “ensuring workers and businesses are equipped to adapt to technological change through investment in education, training, lifelong learning and digital skills.”  

The French government is closely watching a cybersecurity crisis at supermarkets after they were forced to throw out food due to an attack that knocked out refrigerators. 

The office of Prime Minister Sébastien Lecornu told POLITICO that he is “personally monitoring the situation” after cyberattacks targeted the refrigeration systems of several major supermarket chains. Lecornu has asked the country’s cybersecurity agency ANSSI to look into it, his office added.

News reports on Monday said that hundreds of supermarkets were affected. Intermarche and Cooperative U, two French supermarket chains, told AFP that they had been affected. Intermarche told AFP that affected stores will have to throw away affected fresh and frozen food. 

Dominique Schelcher, the CEO of Cooperative U, confirmed on X that a cyberattack hit “the cold production facilities of several stores in our network” since Sunday night.

EU agriculture and food commissioner Christophe Hansen condemned the attack, also mentioning Leclerc, France’s largest supermarket chain, which has not yet publicly confirmed that it is affected. 

French news reports state that the attack hit refrigerators manufactured by Danish company Danfoss. Prime Minister Lecornu’s office said ANSSI has found a flaw in software provided by “a Danish company” and has contacted it. The agency is coordinating with European counterparts as other countries may be affected, the office said.

Danfoss did not immediately respond to a request for comment. 

EU cybersecurity agency ENISA did not immediately respond to a request for comment.

European organizations have to reckon with how to keep up with the modern world without sacrificing sovereignty. Geopolitical instability, tightening regulatory expectations and the rapid adoption of artificial intelligence (AI) mean that, for many organizations, sovereignty now sits alongside resilience and business continuity in board-level risk discussions. The question they can no longer defer is how to harness the opportunities of the modern cloud without surrendering control over their own data. Answering it requires honesty about what sovereignty means, and about where it can actually be found.

A definition Europe can trust

The European Commission’s forthcoming Cloud and AI Development Act (CADA) is the right vehicle for that honesty: giving Europe a shared, enforceable definition of what “sovereign” actually means. Without such a definition, the market is filled with commercial offerings that claim the sovereignty label without delivering the substance, a practice described as “sovereignty washing.” This gap has led some organizations to treat open source as the answer. But open source software is a licensing model, not an operating model, and it doesn’t settle questions about infrastructure or jurisdiction or even reliability and access. It’s not a route out of dependency, it’s a different dependency on project sponsors and code maintainers. A definition gives policymakers a way to properly assess claims of sovereignty against a consistent standard rather than taking marketing at face value.

Europe should not wait for CADA to take effect before acting, though. European cloud service providers (CSPs) have been partnering with established technology providers to deliver real sovereign capability, without rebuilding the entire technology stack from scratch.

The best time to plant the sovereign tree was 10 years ago

If Europe wants to grow its industrial base, it has to support the ecosystem as it is now, not as it may in 10 years’ time. CADA’s own roadmap assumes roughly five to seven years to triple the EU’s data-center capacity. Providers who have already built capacity by blending EU capabilities with proven non-EU technologies would have to spend the intervening years relinquishing their growth. It is scale, not a shortage of skills or innovation, that is the biggest practical obstacle facing a stronger European cloud market. This is precisely why partnership with proven technology sources deserves a central place in the sovereignty debate rather than being treated as a second-best option.

Partnership shortens that timeline considerably, letting European CSPs deliver sovereign, scaled services now instead of waiting for domestic capacity to catch up organically. In Italy, IPZS, owned by the Italian Ministry of Economy and Finance, is using this model to build a modern Digital Application Platform for the Italian EUDI wallet, a foundational EU digital identity initiative. It provides a live example of that model working in Europe today, at the scale and speed the policy window demands.

It is through scale that the local industrial base can deliver sovereign capabilities, compete, capture market share, and invest in developing and integrating home-grown technologies. Hoping for the alternative to happen, that is for a European technological stack to fully emerge and be adopted, is the equivalent of putting the cart before the horse.

The rules need to allow for a model that’s already working

Providers, such as evoila, are now operating well beyond Europe’s borders, alongside Uniserver. This shows the model working at a broader scale, combining local operational and jurisdictional control with proven technology. Sovereignty spans jurisdictional, technological, operational and supply-chain dimensions, and a partnership model can address all four while drawing on technology already proven at scale, rather than asking every layer to be rebuilt from first principles by a single European provider.

Alongside its cloud platform, developed in-house and operated from data centers in Europe under EU jurisdiction, IONOS also offers customers a dedicated VMware-based private cloud. It is also operated within the EU and designed to provide European data sovereignty and operational control.

Broadcom’s role in that model is deliberately narrow. It supplies the VMware cloud software layer to the CSP, while the CSP itself runs the infrastructure and holds the customer relationship, so that no European customer data passes through Broadcom or is subject to its access. Trust, in this model, follows the architecture rather than the brand. If CADA’s tiers implicitly assume that sovereignty can only be delivered by a fully European-built stack, CADA would shut out precisely the route that is already allowing Europe to scale fastest: partnership between local operators and proven technology providers.

The path forward

Europe does not have to choose between moving quickly and building sovereignty. The two are compatible, provided the legislation is calibrated to recognize it. As the European Parliament and European Council work on CADA, the priority should be for it to recognize and reward the partnership models already delivering sovereign capability across Europe today.

The above column is sponsor-generated content.

---

Disclaimer

POLITICAL ADVERTISEMENT

• The sponsor is Broadcom Inc.
• The political advertisement is linked to Broadcom’s software business and advocacy around the Cloud and AI Development Act (CADA).

More information here.

BRUSSELS — The European Union’s cybersecurity agency and in-house research center have each begun experimenting with open artificial intelligence models from China, three EU officials have told POLITICO.

The Joint Research Centre (JRC) — the EU’s in-house scientific research center — is evaluating “publicly available open-weight models” originating from China, European Commission spokesperson Maciej Berestecki confirmed. The head of ENISA, the bloc’s agency responsible for cybersecurity, also said in an interview that his team was now testing Chinese AI.

The experiments with Chinese models at the JRC are part of a broader research project to evaluate artificial intelligence that also includes leading models from the United States and Europe, Berestecki said. “Models from different origins are included in a comparative scientific evaluation of their capabilities, performance, limitations and risks,” he said, adding that the JRC is also looking into their potential scientific applications.

AI safety and security — topics currently under intense scrutiny following a series of incidents in which advanced AI models hacked real-world networks during testing activities — are not the core focus of the JRC’s testing activities, according to a different Commission official, who was granted anonymity to discuss sensitive material.

Open-weight models are those whose core components are publicly released, allowing anyone to run the model and study how it works. China’s approach to AI has leaned more towards open models than the United States. Some major U.S. tech and AI companies, including chips giant NVIDIA, are investing in open-weight models.

Forced to choose

The U.S. and China are locked in a race to dominate in the technology, with Europe largely sitting on the sidelines. Without a viable European frontier model, European private and public organizations may be left to choose between American and Chinese providers for advanced AI applications.

In a recent speech, European Commission President Ursula von der Leyen suggested Europe should not try to win the frontier AI race. A top German tech company told POLITICO this week it was dropping Europe’s leading AI lab Mistral in favor of open-source Chinese models.

The JRC has not entered into any “bespoke access” or licensing negotiations with the relevant Chinese developers, Berestecki said. The models are run on the center’s “secure, on-premises scientific infrastructure” and the Commission is not intending to use Chinese models for its own purposes, he added.

EU cyber agency ENISA — which has gained access to advanced models from top U.S. AI firms Anthropic, OpenAI and Google — is also experimenting with “a couple” of open-weight Chinese models, its executive director Juhan Lepassaar confirmed in an interview on Wednesday. 

JRC and ENISA have been tasked with working together to set up an AI testing platform under a recent EU action plan on AI and cyber, the European Commission’s attempt to respond to the growing concerns after a series of incidents involving AI systems breaking out of testing environments and breaking into other organizations’ digital systems.

Called Explore, Glimpse's new image processing software lets hardware makers speed up quality control checks using CT scanners.