BRUSSELS — The European Commission will assess how well supermarkets are prepared to handle cyberattacks after refrigerators in dozens of stores across at least six EU countries were taken offline.

EU Agriculture and Food Commissioner Christophe Hansen told POLITICO that the attacks would be discussed at the next meeting of its Security College to assess retailers’ contingency plans and their ability to respond to incidents.

“Europe’s food supply chain must be prepared for new and evolving threats,” Hansen said. “The repeated cyberattacks on supermarkets are deeply concerning, causing economic losses for retailers and empty shelves for consumers.”

The announcement follows dozens of supermarkets across Europe reporting disruptions to their refrigeration and freezing systems on Monday.

Incidents were reported in at least six EU countries — Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia — with some retailers reporting that refrigerator temperatures had suddenly surged to as high as 50 degrees Celsius.

Commission President Ursula von der Leyen set up the Commission’s Security College in March 2025 to discuss strategic developments and threats to the EU’s internal and external security.

The Security College format lets commissioners examine attacks beyond their immediate impact on retailers. It also places the disruptions in the broader context of Europe’s vulnerability to hybrid warfare, where attacks on essential supply chains can be used to undermine public confidence.

The Security College meets periodically, separately from the Commission’s regular weekly meetings. On Friday, the Security College discussed the timing of its next meeting, but no date has been set, although heads of cabinet attending the planning meeting agreed it should take place soon, according to an EU official granted anonymity to discuss the behind-closed-door gathering.

The Security College is chaired by von der Leyen and attended by all her commissioners.

The latest disruptions follow a series of cyberattacks in France in October, when hackers appeared to remotely manipulate refrigeration systems by activating their defrosting mechanisms, causing temperatures to rise sharply and food to spoil.

In October, Commission agriculture officials met retailers affected by cyberattacks to take stock of the situation as part of the EU’s food security contingency and preparedness efforts. “We must work at every level to strengthen our preparedness and resilience,” Hansen said.

The commissioner stressed that Europe’s food security is not at risk, but warned that these incidents exposed vulnerabilities in the food supply chain, with consequences for businesses, food waste and consumer confidence.

“These are a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it — a warning that we must take seriously,” Hansen said.

BRUSSELS — Refrigerators in dozens of supermarkets in at least five EU countries were out of service on Monday, local news outlets reported, in what appears to be a repeat of cyberattacks that hit French stores last month.

As of Monday afternoon, there were news reports of incidents affecting supermarkets in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia. 

Several store managers told local media that refrigerator temperatures suddenly spiked to up to 50 degrees Celsius. This mirrors the French incidents last month, in which attackers appeared to remotely manipulate the fridges’ defrosting mechanisms so that they overheated.

It’s not confirmed that the attacks are connected or used the same software vulnerabilities that hit French chains, though one supermarket spokesperson said the incident is a cyberattack “similar to the one in France.”

Ken Munro, a cybersecurity researcher, said in an interview that supermarkets should have disconnected their refrigerators and the devices used to monitor and remotely manage them from the Internet. “I don’t accept any other excuse … particularly in light of the earlier [attacks in France],” he said.

Inti De Ceukelaire, another cyber researcher, also said the incident suggests supermarkets did not take the necessary steps even after the France attacks. “It seems that some of them simply did not get patched, which is quite ridiculous,” he said.

Belgian media reported on Monday morning that temperatures in supermarket refrigerators had suddenly spiked, forcing them to throw food away. A spokesperson for the Centre for Cybersecurity Belgium said the agency is “closely” following the incident, adding that the attackers are unknown and that it “may never be possible to identify them.”

John Billow, director of Sweden’s National Cyber Security Centre, told POLITICO that there are “similarities” to the French incidents and that the agency is in touch with affected organizations. A European Commission spokesperson said it’s aware of the incidents and is using the EU-Cyclone network to coordinate and share information.

Following France

French supermarkets were hit with a wave of similar incidents in mid-October, when attackers targeted refrigerators by Danfoss, a Danish manufacturer of store fridges. Danfoss did not immediately respond to a request for comment. The attacks in France triggered a response from the country’s prime minister and its cybersecurity agency.

Belgian supermarket chain Delhaize alerted its store managers early on Monday morning of problems with refrigerators, and Belgian broadcaster RTBF cited a store manager as saying that the problems were due to a cyberattack like those in France.

A spokesperson for the company said it is aware of an “IT incident affecting the refrigeration systems in a number of Delhaize stores.” A spokesperson for Colruyt, which operates Spar stores in Belgium, said in a statement that fridges in “around five” Spar stores have been affected. “We are currently doing everything we can to resolve the issue,” they said, adding that no Colruyt stores have been affected. 

A Carrefour spokesperson confirmed that 15 of its 700 stores have been affected, and that none of its larger “hypermarket” stores are among them. All stores remain open, they said.

Stores in Sweden have also been hit. A spokesperson for supermarket chain ICA confirmed an “incident overnight affecting a small number of ICA stores operating outside ICA’s central network” which affected its fridges and freezers. 

A Coop spokesperson said seven of its 800 stores were affected but the situation, which is “contained and under control.” In one case, a refrigeration system began to generate heat, they said. Last month in France, the attacks caused at least one fire.

Like the public authorities, cyber researchers are looking for signs of who may be responsible. The fact that the attacks have happened again is evidence to suggest a hostile nation could be behind the attacks rather than young hacker pranksters, De Ceukelaire said. Munro, however, said he believes a “copycat” is behind Monday’s attacks.

“This won’t be the end of it,” Munro added. “There will be more.”

This article has been updated.

Cyberattackers have made “millions” of attempts to take advantage of a critical hole in a building block of the internet, a key cybersecurity provider said early Thursday.

Two top European cyber officials later told POLITICO that hackers have so far struggled to exploit the vulnerability.

Cybersecurity agencies worldwide continue to scramble to respond to the public revelation Wednesday of a flaw in PHP, a foundational computer programming language used to underpin 70% of the internet. 

Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks — giving it a high level of visibility over what hackers are doing — said in a post on X that it’s seen “millions” of “attempts to exploit” the flaw.

Cloudfare saw thousands in the 10 hours before the flaw was publicly announced, meaning information must have leaked, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon’s cloud division also said the flaw is “now being broadly exploited in the wild.”

But Thomas Caspers, vice president of Germany’s cyber agency BSI, said in an interview that though his agency has also seen attacks, it has not seen any successful use of the flaw by hackers. 

“It seems a little bit more complicated than expected to exploit,” he said. “When we had the planning process before the release of the patch, we were expecting a much faster track of the attackers.” 

Caspers is not certain why this is the case at this stage, but said it appears that successfully making use of the flaws is harder than expected. Global cyber officials were part of a process coordinated by OpenAI, to find and fix the flaws. “An ad hoc exploitation seems a little more difficult than expected,” he said.

The challenge for bad actors may also be linked to the major AI providers building guardrails so their tools can’t be used to exploit flaws, he said. When a POLITICO reporter as a test asked ChatGPT and Claude, models from OpenAI and Anthropic respectively, how to exploit the PHP vulnerabilities, both chatbots declined to provide the information. The two companies did not immediately respond to requests for comment. 

Numerous European government departments took their websites offline as a precaution to Wednesday’s developments. As of Thursday morning, key French websites such as the justice ministry and the data protection authority still featured a message they were undergoing maintenance. 

Matthijs van Amelsfort, the head of the Dutch cybersecurity agency, told POLITICO that his agency has no indication that the flaw is “actively being misused” but said that can change, particularly because AI makes it easier to exploit flaws. The agency took its website offline on Wednesday, but it is now back up.

This article has been updated.