On the night of November 2nd, supermarket freezers in ten European countries switched themselves into defrost mode. Three weeks earlier the same thing had happened in nine countries. Nobody had to plant malware for this. Somebody simply logged in.

This is not an isolated prank. It is one data point in a growing list of cyber incidents across Europe that cause physical effects, and that are attributed to Russia, suspected to come from Russia, or, more recently, linked to Iran. Below is a (non-exhaustive) list of what happened in the last months, followed by what I think we, as Europe, need to take away from it.

What happened

Refrigeration sabotage, two waves (October 12th and November 2nd, 2026)

Attackers took over refrigeration controllers in supermarkets in at least nine countries in the first wave (among them Belgium, Luxembourg, Sweden, Ireland and France) and in ten countries in the second wave (among them France, Germany, Sweden, the Netherlands, Luxembourg, Estonia and Switzerland). In France, cabinets reportedly heated up to 50 °C, food spoiled, and some stores reported fires. In the second wave, cold rooms of the French blood donation service EFS were hit as well; staff reacted in time and no blood was lost.

How did they do it? Internet-exposed controllers, default passwords, outdated firmware. No malware, no zero-day. The attackers used the devices’ built-in functions.

Pro-Russian groups Z-Pentest and NoName057(16) claimed the attacks. Security vendors see indicators of a Russian hybrid operation, the Kremlin calls the accusations “absurd”, and the Belgian cyber security agency honestly states that it may never be possible to identify who did it. EU Agriculture Commissioner Christophe Hansen called it a “deliberate attempt to disrupt our food supply chain”. (UNITED24, watson.ch, Tagesspiegel)

A UK power plant offline for four days (July 2026)

According to reporting that started with the Telegraph in August, Iran-linked hackers shut down a small British power generator for four days. The wider grid was not affected, and neither the UK government nor the NCSC has confirmed the attribution. Still, it shows that the Iran war of 2026 has a cyber front, and that it reaches Europe. (SecurityWeek)

Spain: crematorium ovens, a transformer factory, wineries (late 2024 – summer 2026)

Bloomberg reported a series of incidents in Spain: crematorium ovens of a funeral home in Alicante suddenly stopped working; machinery in a Catalan factory producing transformers for renewable energy malfunctioned and caused a fire. The owners initially thought of technical glitches. Investigators link the incidents to a campaign of cyber sabotage tied to the Russian government. The entry point: operator screens (HMIs) reachable over the internet with weak passwords. (Bloomberg, Red Tiger Security)

Poland: heat and power plants (December 2025, attributed July 2026)

At the end of December 2025, attackers tried to sabotage two Polish combined heat and power plants with wiper malware. Had it worked, up to 500,000 people could have lost power – in winter. At a smaller plant, a steam turbine and the water treatment were shut down via a private cellular network.

On July 13th, 2026, the EU and the UK jointly attributed the attack to the FSB’s Center 16 (the folks behind Turla) and imposed their first ever joint cyber sanctions package. According to the EU, the same unit targeted infrastructure in France, Germany, the Netherlands, Austria, Slovakia, Romania, Finland and Cyprus. This is, by the way, the only incident in this list with a solid official attribution. (The Record, TechCrunch, Circuit Magazine)

Poland: water treatment plants (charges filed August 2026)

Polish water treatment plants in Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko and Sierakowo were breached – again via default and weak passwords. Prosecutors in Białystok charged two Russian nationals for 17 attacks. Both are in Russia, out of reach. (TechCrunch, TechTimes)

And the background noise

DDoS attacks by NoName057(16) around elections in Denmark, Poland and Romania – annoying, not dangerous, but the group has become more active since Europol’s takedown operation in July 2025 (The Record). Plus the physical side of the same hybrid war: the attempted attack on cargo planes at Leipzig/Halle airport in August, attributed to Russia, and more than 165 suspected sabotage cases counted by the German BKA in 2026 alone (Al Jazeera, security-network).

What this tells us

Look at the list again and notice what is missing: sophisticated exploits. Apart from the Polish power plant attack, none of these incidents required a nation-state level of skill. They required:

• an industrial controller or HMI directly reachable from the internet,
• a default or weak password,
• firmware nobody updated in years,
• nobody watching.

That is it. Bloomberg’s piece makes the point that many of the people behind these attacks do not even fully understand what they are doing. They do not need to. A shodan search and a list of default credentials are enough to stop a crematorium, flood a pipe system or spoil the food of a whole supermarket.

And attribution? It is getting blurry, and that is by design. State units, state-tolerated “hacktivists”, copycats and bored teenagers all use the same doors. For the defender this distinction does not matter much anyway. A freezer at 50 °C does not care who turned the knob.

We have to get our act together – yesterday

We, as Europe, can no longer afford to treat cyber security and resilience as a cost center, a compliance checkbox or a topic for the next budget cycle. We have been warned for years. NIS2 has been on the table since 2022, and some member states – Germany included – took ages to transpose it. The incidents above are what “later” looks like.

Here is what I think needs to happen, now:

1. Get industrial systems off the internet. No HMI, PLC or refrigeration controller belongs on a public IP address. If remote access is needed, it goes through a VPN with MFA. This is not new advice. It is twenty years old.
2. Kill default passwords. Operators must change them, and vendors must stop shipping devices with them. The Cyber Resilience Act points in the right direction – enforce it, and enforce it early.
3. Patch and inventory. You cannot protect what you do not know you have. Most affected refrigeration controllers were old or ran outdated firmware.
4. Widen the definition of “critical”. A supermarket chain, a blood bank, a mid-sized factory or a small municipal water utility is not “KRITIS” on paper, but the effects of an attack on them are very real. The long tail is where the attackers are going, because that is where the doors are open.
5. Fund the small ones. The Danish water utility hacked by Z-Pentest was breached after switching to a cheaper and less secure solution. Small operators need money, shared services and help – not just new obligations.
6. Detect and respond. Monitoring OT networks, having incident response plans and practising them. Several victims in Spain thought for a long time they had a technical defect. You need to be able to tell the difference.
7. Plan for failure. Resilience means the lights stay on, the water keeps flowing and the food stays cold even if something gets breached. Manual fallbacks, redundancy, spare parts, trained staff.
8. Treat it as security policy, not IT policy. Physical and cyber sabotage are two arms of the same campaign. Protection of infrastructure in the real world and in the cyber world has to be planned together, with the same seriousness we are now (finally) applying to defence spending.

None of this is rocket science. Most of it is boring hygiene that we have been preaching at conferences for decades. The difference is that the bill for not doing it is now arriving – in the form of spoiled food, burned factories and power plants that go dark.

We are out of excuses. Let’s get to work!