Europe's freezer hack and the cable blind spot: two fronts in the same infrastructure fight

The warning came in the NCSC's annual review, published on Tuesday. "It is ... highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI," the agency said, according to The Guardian. CNI, in British usage, covers energy, transport, defence, food, health and finance.

Richard Horne, the NCSC's chief executive, is due to say in a speech alongside the review that "in the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents." He blames AI's ability to find weaknesses in IT systems that have been "tolerated for far too long". The review also states that Russia and China will start using AI "routinely" in cyber-attacks.

That is a forecast, not an observation. The NCSC does not name a perpetrator for the incidents below.

Freezers at 50C in seven countries

The most concrete disruption of the week was not AI-driven at all. On Monday, supermarket chains in at least seven European countries said fridge and freezer temperatures in some shops had climbed overnight to as high as 50C (122F), The Guardian reported. Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems. Several confirmed they had been hacked.

It was the second such wave in a month. An attack in France in October seized control of cooling units in as many as 700 supermarkets. It raised temperatures as high as 50C and caused fires and food losses estimated in the tens of millions of euros. Christophe Hansen, the EU food and agriculture commissioner, called the repeat incidents "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it".

"We started mobilising technicians at 1am. We spent all night and morning disconnecting the affected installations."

That was Stephan Moelans, chief executive of Sabcobel, which operates Delhaize's refrigeration systems, speaking to Belgium's Le Soir. Ahold Delhaize said fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg had been hit. Reporters visiting a shop north-east of Brussels saw empty shelves and a sign apologising "due to cyberattacks".

The numbers vary by retailer, and the reporting reflects that rather than a single tally. CNBC reported that Colruyt Group said five of its Spar stores in Belgium were targeted. Carrefour told the BBC 15 of its Belgian stores were attacked, and Intermarché said 15 of its 153 stores in Belgium were affected. IKEA told CNBC a cyber incident hit refrigerators and freezers at its Mons store in Belgium between Sunday and Monday, with "limited impact" on its restaurant and Swedish Food Market. ICA, Sweden's largest grocery retailer, said a "limited number of stores" on networks outside its central systems were affected. Finnish Kesko, Irish chain Supervalu and Estonian grocer One Selver also reported disruption, per CNBC. The European Commission said it was in direct contact with national authorities. It convened a meeting on Monday morning of its interinstitutional Task Force with ENISA and Europol.

Default passwords, not large language models

The mechanism behind the fridge attacks looks mundane. Paul Chichester, the NCSC's director of operations, said on Tuesday that the incidents were not AI-enabled. They used vulnerabilities that had been "out there for a long period of time". He said the NCSC was working with affected organisations in the UK, where the national impact was minimal.

The Guardian reported that the French attack involved legacy technology connected to the internet with default passwords. Xavier Bellekens, chief executive of the cyberdefence firm Lupovis, told the paper his company logged 256 attempted attacks from 91 different sources between 20 October and 30 October. The targets were online "honeypot" traps built to look like Danfoss fridge controllers. Most authentication attempts used the manufacturer's publicly documented factory-default username and password.

The British Association of Independent Meat Suppliers told the BBC that some of its more than 300 members had been affected. One company's cold units heated to up to 100C and two others reported defrosting. Aims said the units were empty and no produce was lost.

Horne's framing of all this is the phrase of the week. The fridge attacks represent the "foothills" of a larger threat, he said at the review's launch. The metaphor is doing a lot of work. It concedes that what has happened so far is small, while arguing that the terrain ahead is worse.

The cables nobody is heating up

The same day as the NCSC launch, Tom's Hardware reported that a Chinese survey ship loitering near an undersea cable had ignored Philippine demands to withdraw. The vessel reportedly ignored radio contact and broadcast a false ID. It manoeuvred to evade capture before the Philippines sent its largest vessel, which was spotted 37 nautical miles from Batanes province.

A Chinese coastguard ship intervened, and Beijing complained of harassment afterwards, according to the South China Morning Post as cited by Tom's Hardware. There have been no confirmed reports of Chinese attacks on undersea cables. A Center for Strategic and International Studies report found Chinese research ships spend more time loitering near cables than any other nation. The think tank called the pattern "disproportionate".

Mapping is not cutting. But the distinction matters less once you accept that the same class of operational technology sits under both stories. That equipment is remotely reachable and often unpatched. Sweden's national cybersecurity centre said it had established the country has "quite a lot of exposed operational technology devices" that need updating or patching. Its head John Billow told Reuters, as quoted by The Guardian.

Ollie Whitehouse, the NCSC's chief technology officer, made the consumer end of the argument on Tuesday. Manufacturers need encouragement to make connected devices safer, and consumers need to accept paying more for safer equipment. That is a procurement argument dressed as a security one, and it applies to a supermarket compressor as much as to a router.

Vendors move, and so do attackers

Commercial responses are arriving on their own schedule. On Tuesday, Bull and Schwarz Digits, the IT and digital division of Schwarz Group, signed a memorandum of understanding, HPCwire reported. They aim to build what they describe as an independent, secure European AI and cloud infrastructure ecosystem. The plan puts Bull's BullSequana AI platform into Schwarz Digits' STACKIT Marketplace, with servers from Bull's Angers factory and direct liquid cooling.

Emmanuel Le Roux, Bull's chief executive, said the aim is to give European organisations capabilities "they can deploy and control". The MOU also covers co-design of servers on Open Compute Project standards, SAP RISE integration and exploratory work on quantum computing. It is a memorandum, not a contract, and no figures were disclosed.

On the offensive side, OpenAI said on Tuesday it had hired former US Army Secretary Dan Driscoll as senior counselor for national security modernisation, a new role, CNBC reported. Driscoll resigned as Army secretary this year after reported tensions with Defense Secretary Pete Hegseth. Sam Altman said the US has "an extraordinary opportunity to work with other countries to spread the adoption of democratic AI".

OpenAI also quadrupled bug bounty payouts, The Decoder reported on Tuesday. Critical vulnerabilities in products such as ChatGPT or Codex now earn outside researchers up to $30,000, exceptional findings up to $100,000, and with bonuses roughly $172,000. During its last internal security sprint, 25 percent of OpenAI's product engineers worked on finding vulnerabilities, according to the company.

Not every breach is dramatic. Tom's Hardware reported on Monday that Nvidia's Brev cloud development platform saw unauthorised activity between 4 and 20 October, with SSH keys potentially exposed. Nvidia said it rotated the keys and updated customer instances, and found no evidence of misuse. It did not explain how attackers got in.

What the week actually shows

Two things can be true. The freezer attacks were crude, built on default credentials and old flaws, and were contained in most cases. Intermarché told CNBC that security measures let it respond quickly. A few stores suffered stock losses "nothing comparable to the attack in mid-October".

And the NCSC's forecast is a forecast. Alan Woodward, a professor of cybersecurity at Surrey University, told The Guardian that AI can help find and patch flaws, "but if we don't get the access the bad guys will beat them to it". The agency cited one data point for AI's capability. Last month the technology helped discover a critical weakness in PHP, a language used by almost 70 percent of the world's websites.

The undersea cable picture is harder to price. No confirmed cut is linked to the September incident near Batanes, and no confirmed Chinese attack on a cable exists at all. What exists is a pattern of loitering and a think tank's finding that it is disproportionate. The Philippine coast guard also had to send its largest vessel to shadow a research ship.

For European operators, the practical overlap is unglamorous: inventory. The fridge wave spread because cooling units were reachable from the internet with credentials anyone could look up. The cable risk grows because seabed infrastructure is being mapped faster than it is being protected. Neither problem is solved by a better model.