Since mid-October, Europe has recorded a series of events that, taken separately, could indicate cybercrime, malice, or false alerts. However, their increasing frequency within a short time has now drawn the attention of European authorities.
Hundreds of supermarkets in France first experienced remote manipulations of their refrigeration systems. A few weeks later, similar incidents struck chains in several European countries.
Then, starting November 2, bomb threats targeting civil aviation surged. Commercial planes were redirected, terminals were placed under surveillance, and fighter jets were mobilized to escort certain aircraft.
By November 5, over 30 flights had been affected by alerts or security measures during the week. Inspections revealed no explosive devices.
These incidents do not demonstrate the existence of a coordinated operation. Nonetheless, they raise a fundamental question about the vulnerability of European infrastructures.
1. Bomb alerts multiply in European skies
The new wave begins on Monday, November 2, 2026, when a Wizz Air flight from London to Sofia, Bulgaria, is diverted to Budapest due to a bomb threat.
The plane is escorted by a Hungarian fighter jet before landing safely. No explosives are discovered.
The next day, several airlines experience similar incidents.
Ryanair, Wizz Air, LOT, and SAS flights are notably affected. Verification procedures are initiated in Spain, Italy, Poland, and Bulgaria.
By Thursday, November 5, the situation escalates further.
Among the most notable events is the diversion of an Airbus A320 operated by Aer Lingus on the Dublin-Rome route.
The aircraft is directed to the French airbase in Évreux, Normandy, following an alert communicated by Italian authorities.
Two French fighter jets intervene. The 151 passengers and six crew members are secured. Bomb disposal teams then carry out the necessary checks.
Other flights to Sofia, Rome, Warsaw, or Prague are subject to similar measures.
Traffic is disrupted, some runways are temporarily closed, and security services must be urgently mobilized.
Although the threats have proven unfounded, their operational consequences are significant.
2. Supermarket freezers become targets
The other series of incidents affects an area seemingly very distant from aviation: the food retail sector.
On the night of October 11-12, 2026, a cyberattack disrupts the refrigeration systems of nearly 700 stores in France.
The hackers manage to remotely change the settings of some installations, causing abnormal temperature increases.
The consequences are immediate: spoiled goods, perishable items rendered unfit for consumption, and economic losses for retailers.
On November 2, similar incidents are reported in several other European countries.
In Sweden, an ICA Kvantum supermarket located in Sjöbo reports that its refrigerators and freezers were set to 50 °C.
Such a high temperature in equipment intended to preserve frozen products leads to a major breakdown of the cold chain.
Employees must empty the shelves and dispose of some merchandise.
In Belgium, Ireland, Finland, Estonia, Luxembourg, the Netherlands, Portugal, and Italy, other retailers report comparable anomalies.
As confirmations roll in, reports extend to at least eleven European countries.
The affected chains include Carrefour, Delhaize, ICA, Coop, Intermarché, and SuperValu.
3. How can a freezer be hacked?
The answer lies in the digital transformation of industrial equipment.
Modern refrigeration systems are no longer necessarily isolated systems. They can be connected to computer networks, allowing temperature monitoring, anomaly detection, and remote maintenance operations.
This connectivity improves their efficiency but also creates new potential entry points for cybercriminals.
In several European incidents, equipment using solutions from the Danish manufacturer Danfoss has been implicated.
This commonality is attracting the attention of investigators. However, it does not mean that all products from this manufacturer have the same vulnerability or that its central infrastructure has necessarily been compromised.
In some stores, systems may have been placed in defrost mode. In others, temperatures may have been deliberately increased.
The consequences can be severe without the need to physically destroy the devices.
A simple unauthorized alteration of settings can be enough to cause significant food losses.
The stakes extend beyond supermarkets: many other sectors use similar connected equipment, including logistics, the food industry, and some healthcare facilities.
4. Economic losses could reach several million euros
The financial consequences of cyberattacks against refrigeration facilities are already significant.
In France, the incidents in October are estimated to have caused several million euros in damages. In Belgium, a butcher has assessed his losses at around 15,000 euros.
These amounts do not only concern destroyed goods. Companies must also cover cleaning, health inspections, technical interventions, and potential temporary closures.
Additionally, there are costs associated with air alerts.
When a commercial airplane is diverted, the mobilization can involve air traffic controllers, bomb disposal teams, police forces, military aircraft, and passenger assistance services.
The overall cost of the aerial incidents this week is not yet known.
But one observation stands out: it is possible to provoke costly disruptions without detonating a bomb or physically destroying an infrastructure.
5. A form of hybrid warfare?
This is the hypothesis that is beginning to raise questions.
Hybrid warfare refers to the combined use of conventional and unconventional means to weaken or destabilize an adversary. It can include cyberattacks, sabotage, disinformation campaigns, and economic disruption operations.
The incidents recorded in Europe exhibit certain characteristics typical of such operations.
At airports, anonymous threats are enough to trigger exceptional security measures.
In supermarkets, manipulation of connected systems allows for material losses without physical intrusion.
Both categories of incidents have a common thread: they affect services used daily by the public.
However, there is a crucial difference between observing methods that could be employed in hybrid warfare and demonstrating that a hybrid warfare campaign is actually underway.
At this stage, no public evidence allows us to claim that the bomb alerts and freezer attacks are part of a coordinated operation.
We must determine the identity of the perpetrators, their motivations, any potential links, and the technical means employed.
6. Who could be behind these incidents?
The question remains open.
Regarding the cyberattacks against refrigeration facilities, no group has publicly claimed all of the operations in a verified manner.
The apparent absence of ransom demands in some cases leads experts to explore the possibility of sabotage rather than traditional financial extortion.
But other explanations remain possible, including opportunistic cybercrime or exploitation of inadequately secured systems.
On the side of aviation threats, some alerts were transmitted via email.
Messages targeting certain flights and received particularly in Italy and Bulgaria claimed to come from "male state fighters," a term that may refer to an ultra-nationalist Russian movement.
However, the authenticity of this attribution has not been established. A signature in a threat message does not constitute proof of the author's identity.
The European Commissioner for Transport, Apostolos Tzitzikostas, stated on November 5 that it is still too early to determine if the various aerial incidents are linked.
No verified information allows attributing all of these events to a foreign state either.
7. Brussels begins to take the threat seriously
European reactions indicate that these incidents are no longer viewed merely as localized technical issues.
The European Commissioner for Agriculture, Christophe Hansen, condemned the repeated attacks on refrigeration systems, considering them a disruption attempt to the food supply chain and consumer trust.
In Italy, authorities organized emergency meetings with intelligence officials following the surge in incidents targeting refrigeration facilities.
Investigations are focusing on remote access to industrial equipment, monitoring systems, and vulnerabilities that may be exploited simultaneously across multiple countries.
The stakes are now European: a safety flaw present in widely deployed technology can affect hundreds of establishments across different territories.
The repeated air alerts raise a comparable but different issue: how to maintain essential security procedures without allowing malicious actors to disrupt traffic permanently?
8. What if the true target was the trust of Europeans?
Beyond the immediate damages, these incidents highlight a less visible fragility: trust in the daily functioning of essential services.
A passenger hearing that their flight was diverted after a bomb threat does not immediately know if it is a real threat.
A consumer discovering that freezers have been remotely manipulated may question the safety of goods offered in stores.
For businesses, the recurrence of these events leads to increased expenses, technical adaptations, and heightened pressure on operational staff.
If these disruptions were to prolong, they could also alter consumer habits and business security strategies.
This potential consequence does not prove that the perpetrators are deliberately seeking a psychological effect. However, it constitutes one of the most concerning dimensions of these incidents.
Conclusion: Should Europe prepare for a new form of sabotage?
The events of October and November 2026 reveal a reality: modern infrastructures can be disrupted without the need for a major physical attack.
Connected refrigeration systems can become points of economic vulnerability. Anonymous messages can suffice to immobilize planes, mobilize military forces, and disrupt airports.
Investigations will still need to determine if the cyberattacks against supermarkets are interconnected, who is behind the air alerts, and whether some operations pursue goals beyond mere malice.
For now, the two phenomena must be considered separately from a legal and technical standpoint.
But their simultaneous occurrence raises a strategic question that goes beyond the incidents themselves: have European societies sufficiently anticipated the risks associated with increasingly interconnected and interdependent infrastructures?
The most challenging threat to manage is not necessarily the one that causes the most destruction. Sometimes, it is the one that forces authorities and businesses to mobilize significant resources without immediate identification of its origin, extent, or goal.
