A Belgian butcher is awakened at 3:30 in the morning by an employee reporting a problem with his refrigeration system. When he reaches his shop, temperatures have climbed to 18° Celsius. He estimates that about $17,000 worth of meat has been ruined. Elsewhere in Europe, supermarket workers have discovered similar problems.
The refrigeration attacks were reported in early November, around the same time that European airlines faced a wave of anonymous bomb threats. On the worst day so far, November 5, at least 21 flights had been targeted, prompting diversions, security inspections, and disruption to airline schedules. There is no established connection between the two sets of incidents.
Supermarket chill cabinets and short-haul airline flights are not what most Europeans picture when they hear about Russia’s shadow war. They think of espionage, cyberattacks against government networks, suspicious fires at defense factories, or damaged infrastructure in the Baltic Sea. These are serious threats, but for most people they remain distant. A disrupted neighborhood grocery store or a grounded holiday flight is different. It brings the consequences home.
There is no publicly established evidence that Russia was behind these incidents, and that distinction matters. But so does the vulnerability they exposed.
Most people understand cybersecurity through information technology: stolen passwords, compromised email accounts, ransomware, and the theft of personal information. Far fewer are familiar with operational technology, or OT, even though they depend on it every day.
OT controls physical processes. It regulates refrigeration equipment in supermarkets, pumps and chemical treatment in municipal water systems, machinery in factories, and equipment across electrical grids and transportation networks. These systems make modern societies function.
Compromising these systems can have physical consequences, ranging from spoiled food and interrupted production to electrical outages or unsafe water treatment. The severity depends on the equipment involved, the attacker’s access, and the safeguards in place.
Much of this equipment was designed for reliability and long service lives, often before cybersecurity became a central consideration. Remote connectivity has improved efficiency and maintenance, but it has also introduced new vulnerabilities. Equipment that once required physical access can sometimes be reached through poorly protected network connections.
The refrigeration incidents illustrate the problem. Attackers reportedly manipulated remotely accessible controllers, changing temperatures and interfering with normal operations. The technology involved was neither exotic nor uniquely sensitive. It was ordinary commercial infrastructure performing an essential function.
Europe’s OT vulnerabilities are as much an institutional problem as a technical one. Much of this infrastructure is owned and operated by private companies, utilities, and local authorities. Responsibility for its protection is divided among operators, manufacturers, regulators, and security agencies, often across national boundaries. Hostile actors can exploit those seams. Governments need clearer arrangements for sharing threat information, identifying common vulnerabilities, and coordinating responses across jurisdictions.
Russia is a reasonable line of inquiry, but not a conclusion. European security services have documented Russian sabotage, cyber operations, and the use of recruited intermediaries to disrupt European interests, particularly support for Ukraine. Latvia’s State Security Service, among others, has described the use of intermediaries to distance Russian intelligence services from operations on the ground.
There is also precedent for the use of anonymous bomb threats as a means of disruption. Ukraine’s Security Service attributed extensive bomb-hoax campaigns in 2021 and early 2022 to Russia, including threats against schools, government buildings, transport facilities, and other civilian targets. That history warrants attention, but it does not establish responsibility for the current incidents.
A suspicious warehouse fire in one country, a railway disruption in another, and an intrusion into commercial equipment elsewhere may never be examined together. Some incidents will prove unrelated. Others may be part of a coordinated campaign. The difficulty is recognizing the difference before repeated disruptions impose costs that exceed the damage from any individual event.
The distinction between individual incidents and a coordinated campaign is therefore critical. Recognizing a pattern is not the same as proving that every event belongs to it. But treating each incident in isolation can obscure the larger picture.
European governments also need agreed options for responding when Russian responsibility is established. Those options should be developed in advance, calibrated to the evidence and the activity involved, and designed to impose costs that change Moscow’s calculations rather than simply register disapproval.
The need to impose costs does not diminish the importance of protecting vulnerable infrastructure. An adversary does not need to penetrate a military network or destroy a major power station to disrupt civilian life.
A poorly secured controller, an exposed remote connection, or a compromised service provider may provide an easier route to disruption.
The refrigeration attacks have not been publicly attributed. Criminals and state-directed actors can exploit the same vulnerabilities, and the technical characteristics of an intrusion do not necessarily establish who directed it or why.
Assigning responsibility to Russia without evidence would be irresponsible. But attribution and protection are different decisions.
Establishing responsibility for an attack, particularly when considering punitive action against another state, demands credible evidence. Securing vulnerable infrastructure does not.
European governments must work harder, in partnership with operators and manufacturers, to identify exposed OT systems, restrict remote access, and ensure that essential processes can continue safely if network connections are compromised. Equally important, they need arrangements that allow technical indicators and threat reporting to move quickly among cybersecurity authorities, intelligence services, law enforcement, and private operators, including across national borders.
Resilience alone is insufficient. Europe also needs to become a more difficult operating environment for hostile intelligence services and their proxies. That requires exposing hostile activity when the evidence supports it, hardening vulnerable systems, disrupting the networks and intermediaries enabling attacks, and imposing meaningful costs on those responsible.
The objective should be to prevent individual disruptions from accumulating into strategic advantage.
The immediate consequences of these incidents are spoiled food and financial losses. The longer-term concern is confidence in the systems people depend on but rarely think about.
Europeans expect electricity, safe drinking water, and reliable food supplies. They also expect their governments to understand threats and respond effectively. An adversary seeking to undermine public confidence need not cause catastrophic damage. Repeated disruptions, particularly when responsibility remains unclear, may be enough to raise doubts about whether essential services can be trusted.
European governments need to avoid two mistakes: treating every unexplained disruption as a Russian operation, and treating uncertainty about attribution as a reason to defer protective action. The first undermines credibility. The second leaves vulnerabilities available for the next attacker.
The refrigeration attacks and airline bomb threats may ultimately prove unrelated to Russia—or to one another. Both nevertheless demonstrate how relatively modest actions can disrupt ordinary life, impose economic costs, and test public confidence in essential services.
Europe cannot wait for Russian fingerprints before protecting the systems its citizens depend on.
David M. Cattler is a Senior Fellow at the Center for European Policy Analysis (CEPA). He is a senior transatlantic security leader with more than 35 years of experience across the US government, NATO, and the Intelligence Community. Most recently, he served as Director of the Defense Counterintelligence and Security Agency (DCSA) and was previously NATO’s Assistant Secretary General for Intelligence and Security, the alliance’s senior intelligence official. Cattler is a graduate of the US Naval Academy and Georgetown University and was an MIT Seminar XXI Fellow.
Europe’s Edge is CEPA’s online journal covering critical topics on the foreign policy docket across Europe and North America. All opinions expressed on Europe’s Edge are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
