Be ready. Or maybe not?

Sun, 08 Nov 2026 17:08:55 +0000

In the space of a fortnight Europe got hacked freezers in hundreds of supermarkets, thirty-odd hoax bomb threats on airliners, and a British government telling families to keep three days of food and water at home. It all looked like one story. I spent days trying to work out whether it is – and the answer is: partly, and not in the way it looks.

In Sjöbo, in southern Sweden, on the morning of 2 November the staff of the local ICA Kvantum open the shop and find the frozen food thawed. No door forced, no alarm tripped, no power cut. Somebody, somewhere in the world, in the middle of the night, told the freezers to go to 50 degrees, and the freezers obeyed. The manager writes it on Facebook with the resignation of a man who has just thrown away a stockroom: we've been hacked, they set the temperature to 50.

In the same hours, in Brussels, Stephan Moelans, managing director of Sabcobel, the company that runs the refrigeration for Delhaize supermarkets, is waking up his technicians. At one in the morning. He sends them out across Belgium and Luxembourg to do something that in 2026 sounds almost medieval: physically unplug the fridges from the network, shop by shop, before the rest of the stock melts. As he told the Belga news agency afterwards:

We began mobilizing technicians at 1 a.m. to get the situation under control

Three days later an Aer Lingus Airbus from Dublin to Rome lands at a French military base at Évreux, under fighter escort, while bomb disposal teams search it. They find nothing. On the same day some twenty other flights across Europe receive the same threat, and meanwhile the British tabloids are explaining to their readers which fourteen items to buy in order to survive an emergency nobody has declared.

Within a week you get the feeling of being inside a dystopian novel that somebody is writing too fast. I spent days collecting the pieces. This article is an attempt to put them in a row, separating what we know from what we think we understand. Because the two, as we'll see, don't coincide.

The week

Let's rewind the tape. In mid-October, in France, the fridges of a few hundred supermarkets (between 250 and 350 stores according to the technical reconstructions, up to 700 according to others, across the Intermarché, Coopérative U, Carrefour Market and Leclerc chains) are driven overnight up to 50 degrees. Stock to throw away, and in a few shops the beginnings of a fire, because a fridge that heats is an appliance doing something it was never designed to do. The attack gets told as a French story, but the analysis by Sekoia picked up by Reuters finds units hit in Spain, Portugal, Poland, Germany and Belgium too: the continent was already in it, nobody had counted it yet.

On the night between 2 and 3 November it happens again, this time on a continental scale: at least nine countries. Ireland, Belgium, Luxembourg, Sweden, the Netherlands, Finland, Estonia. Among the brands hit, Ikea, Delhaize, Carrefour, SuperValu (thirteen shops in Ireland). In Estonia the technicians step in within minutes and contain the damage; in Sweden ICA talks of “a limited number” of stores, which is the formula you use when you'd rather not say the number. In Athens a butcher tells the TV that his display fridge was set to 150 degrees, and that it took the technician two hours to get it back under control. And it isn't only frozen food: the same night Coolworld is attacked, the refrigeration supplier of the Établissement français du sang, the French blood transfusion service. Blood bags are not something anyone resells on the black market.

Then the emails. On Monday 2 November Hungary scrambles a Gripen to escort a Wizz Air flight from Luton to Budapest, threatened while already airborne. By Tuesday 3 the threats are already around thirty, twenty-seven according to the AP, plus a cruise ship; a Warsaw airport closes for a few hours. On Thursday 5 at least twenty-six are reported across Europe, on flights departing from sixteen countries. On Friday 6 another seventeen by noon, nine in Prague alone. Hungary scrambles its Gripens three times within an hour to escort a Brussels-Sofia and two flights out of Prague bound for Cyprus and Romania. In Dublin the headquarters of RTÉ, the Irish public broadcaster, is evacuated, and two other broadcasters receive threats the same day. Not a single device is found. Anywhere.

And finally London. On 22 October the Cabinet Office launches “Be Ready”, a three-year campaign asking families to keep enough at home for three days of self-sufficiency: water, food, a torch, a wind-up radio, cash, copies of documents. The same day the Defence Secretary, Wes Streeting, backs it with a line about “increasingly sophisticated cyber attacks”, and the next day the Prime Minister, Andy Burnham, defends it in person at a wildfire summit (and tells the Guardian about his own stash: beans, soup and Twiglets). From 27 October the papers start turning the same page of the government website over and over: the Independent headlines on the “attacks”, the Express on the “14 items to stockpile”, one news site on the “4 foods to have at home” (declared source: a Reddit thread...), another on the “13 things” to buy. Barclays publishes a survey: one Briton in four is stockpiling.

Four facts in fifteen days. Three of them are true. One is half true. And the question worth asking is whether they have anything to do with one another.

The radiator

To understand what happened in the supermarkets you need to know something supermarkets would rather not tell you: the fridge in a modern shop doesn't have a thermostat, it has a computer. It's called a controller, and in this case it's almost always a Danfoss of the AK-SM 800A series, a Danish box whose job is to let the maintenance technician check the temperatures of fifty shops from his sofa instead of driving round in a van. Convenient, and sensible too: if a display cabinet fails at three in the morning, somebody sees it straight away.

The problem is that this computer has a web page, and that web page, in hundreds of shops, was reachable by anyone on the internet. It's as if the thermostat in your house had a door onto the landing, with the key left in the lock. And as if the key were also printed in the instruction manual: many of the logins used factory passwords, the ones written in the manual you download from the manufacturer's website. After the French attack, researchers put fake controllers online to see who came knocking, and whoever came knocking tried exactly those passwords.

There was no stroke of genius. The main flaw, catalogued as CVE-2025-41450, lets you skip the controller's login screen. It was found by researchers at a security firm, Claroty, along with two others. Danfoss disclosed them in March 2025, published the fix in August 2025, and the American CISA issued an advisory the same year; Claroty's detailed technical report came out in August 2026, complete with a count of the controllers reachable from the internet: thousands. It wasn't even the first time: back in 2023 Dutch researchers had found three vulnerabilities in the same family of devices. Danfoss itself admitted that most of the systems hit were old products no longer receiving updates, and another manufacturer, Copeland, found a flaw in its own end-of-life controllers. A researcher interviewed by the Associated Press put it better than I could:

Nobody broke into these refrigeration systems with a zero-day

And the NCSC, the British cybersecurity agency, in its statement to the AP:

The cyberattack on French supermarkets was a result of exploitation of known vulnerabilities

Translated for those who don't do this for a living: the door had been open for a year and a half, everyone who needed to know knew, and in the end somebody walked in. Surprising, isn't it?

Once inside, the attacker didn't even have to write a malicious program. They pressed “defrost”, the de-icing function every industrial fridge has as standard, and held it down all night. A security expert interviewed by Gizmodo, Lamplmair, put it like this:

A freezer should never accept an instruction to heat to 50°C

Who did it, nobody knows. Two pro-Russian groups, NoName057(16) and Z-Pentest Alliance, claimed it on Telegram, posting what they say are 2,500 lines of data stolen from Danfoss, and then deleted the posts. It's worth what it's worth: NoName habitually claims anything that happens in Europe, and no security agency has confirmed. What the agencies have confirmed is that this isn't a bored teenager: researchers at Lupovis saw days of reconnaissance before the night of 2 November, with login attempts coming from “bulletproof” hosting, the kind that doesn't answer police requests. Somebody did their homework, and chose targets that don't earn a penny. The Pentagon, meanwhile, is still investigating the freezers of more than half a dozen American military commissaries that went haywire in late August, and is coordinating with the French. The FBI and four other federal agencies have published an advisory to cold-chain operators. And the head of British cybersecurity confirmed that in the UK too there has been “a small number” of incidents of the same kind.

The emails

The mechanism behind the threats against aircraft, as far as the police have said, is disarmingly banal: anonymous emails, sent in bulk to several airports with the list of “mined” flights. The Czech police said the email that reached Prague was addressed to the airport and that similar emails had reached other European hubs. The Danish police, on Friday, in a statement picked up by Reuters:

We are once again at Copenhagen Airport today in connection with threats directed at air traffic

And the office of the French Prime Minister:

An investigation is underway to determine the source of these alerts

In Spain the Guardia Civil received three in twenty minutes, on Air Europa departures from Madrid and Iberia arrivals from Rome and Milan. In Rome, on the other hand, one threat came by telephone to the control tower at Fiumicino. The protocol, at that point, leaves no room: the aircraft lands where it can, fighters escort it if needed, bomb disposal searches it, passengers wait on the apron. It costs tens of thousands of euros per flight and it's done anyway, because the alternative isn't on the table. In the Aer Lingus case, by the way, things went less smoothly than the press told it: according to Prime Minister Lecornu's office the fighters were sent after the pilot had failed to cooperate as expected, and pilot and co-pilot were questioned by the Évreux prosecutor before being allowed to leave. Aer Lingus says they acted impeccably. That too is part of the cost.

The number that puts things back in proportion came from Eurocontrol, the European air traffic body: the 14 flights affected on Thursday were 0.05% of the 26,300 flights on the European network that day. “Minimal” disruption, says Eurocontrol. The “flights in chaos” of the headlines never existed: the thousands of delays circulating in the same days were the normal delays of Heathrow, Charles de Gaulle and Schiphol, which produce them by the hundred every day with or without threats. The real effect of the emails isn't on air traffic. It's on people's heads, and on the coffers of the states.

Who did it, here too, nobody knows. The British government called them “malicious hoax threats”. The European transport commissioner said it's “too early” to say who is behind them, and even whether the episodes are linked to one another. Moscow denied, and there is no evidence of Russian or Iranian involvement, or of groups tied to them. There is actually one jarring note, reported by a single source and which I couldn't verify elsewhere: the threats against flights bound for Rome supposedly came from a group calling itself anti-feminist, which would suggest either several different hands jumping on the bandwagon, or a signature planted there to mislead. A private security analyst, Borie, told the AP that the European focus “could have a Russian angle”, adding straight away:

Iranian hybrid warfare is just as active in certain pockets of Europe

Experts from the various countries will meet in Brussels next week. Allow me to be sceptical: either the data exists, and then it should be made public, or it doesn't, and then there are only suspicions. And filling the headlines with a Russian threat on the basis of suspicions, I don't know whether that's more irresponsible or more reckless.

That said, the precedent everyone has in mind, without saying it too loudly, is 2024: waves of bomb threats against schools and courts in Czechia and Slovakia, about which the head of the Czech intelligence service Michal Koudelka spoke publicly like this:

There is clearly a visible Russian trace

And before that the incendiary parcels in DHL depots in Germany, Poland and the UK, where the European investigation identified 22 suspects recruited in Russia, the Baltics and Ukraine, often people in financial trouble paid for an odd job. That is evidence. This, for now, is an analogy. The difference between the two is the only thing that matters, and it's worth holding on to.

The leaflet

And then there is the United Kingdom, where for two weeks you get the impression that the government is talking to its citizens non-stop. It isn't. The “Be Ready” campaign wasn't born this week. It had been planned at the start of the year by the Starmer government, announced in September, and was published on 22 October. And it's the British version of something the Nordic countries have done for decades: Sweden sends every household a leaflet titled “If crisis or war comes”, and has done so since 1943. A report by former Finnish president Sauli Niinistö to the European Commission, two years ago, recommended exactly those 72 hours of household self-sufficiency to all member states, and Brussels adopted it. The context is declared: last year's British national security strategy explicitly names Russian aggression, hostile cyber activity and sabotage. It's no secret, it's a public document.

On 23 October the Prime Minister defended the advice saying that “unexpected events” are becoming more common, and the Defence Secretary had his say. From there on, though, it's no longer the government talking. It's the press parroting (if only it were stochastic...) whatever sells copies. A site that checks these things, Prepared Britain, looked at the GOV.UK page on 3, 4, 5 and 6 November: no new guidance, no emergency instruction, no department telling anyone to prepare for a war. The “attacks” in the Independent's headline were a word lifted from the campaign's original text, which talks about bad weather, blackouts, water and phone outages. The Express's “14 items” were the list of 22 October. The “4 foods” came from Reddit. And in the middle of all this, the Met Office's ordinary weather bulletins ended up in the same notification stream, indistinguishable from the rest.

The only truly new thing on the British front is the speech by the head of the NCSC, the cybersecurity agency, who in the same week as the fridges talked about empty shelves and lights going out:

When food isn't on shelves, lights aren't on, businesses have gone under

He said that one day we might have to explain why we had seen the signs and not chosen well, and confirmed the British incidents tied to the controllers. That one is an explicit link between the fridges and the wind-up radio. Made by someone who has the data to make it.

Three actors, but no director?

Having got this far, the temptation is strong, and I admit I was the first to feel it: all of this looks orchestrated. Fridges, planes, leaflets, all in the same fortnight, all pushing in the same direction: get used to it, get ready, something is about to happen that we know about and you don't. It's a legitimate hypothesis, and I put it on the table as such.

Let's call it hypothesis A: the alarms are manufactured, or inflated, to prepare the population for a crisis someone has already decided on or already sees coming. In its favour: the timing, the convergence of interests, the fact that Europe's military chiefs openly talk about a possible confrontation with Russia within a few years. The German chief of defence Carsten Breuer, in May:

Various indicators all point to one possible date of a Russian attack on NATO: 2029

and he adds “or even earlier”. His minister Boris Pistorius:

By 2029 or 2030, Putin could strengthen his army to the point where Russia would be capable of striking NATO

The French chief, Burkhard, says 2030. And the Czech general Karel Řehka:

Most of us, defense chiefs, share a similar view

Against it, though, weigh the fridges. There you have stock destroyed by the million, private companies losing real money, a supplier sending technicians out at one in the morning, blood bags at risk, American bases hit since August. It's a physical event, with real economic victims and a technical vector that anyone with a search engine for connected devices and the Danfoss manual can verify for themselves. No European government has any interest in burning its own supermarkets to educate public opinion, and it would be a strangely expensive and traceable way of doing it. The same goes for the emails: every diversion with Gripens in the air costs the state money and embarrassment, and the day one of those emails were traced back to a friendly service the political damage would be devastating. The cost-benefit ratio of “doing it to yourself” is terrible.

Then there's a number that weighs against the very premise of a “fortnight of stage direction”. Forescout counted more than twenty claimed attacks on refrigeration systems between January and October 2026, and the most active groups were precisely Z-Pentest and NoName057(16). This isn't a sudden escalation: it's the visible tail of a campaign that has been running for a year, and that only became news when it hit enough supermarkets on the same night. The feeling of orchestration comes from the media's attention threshold, not from the real density of events.

Hypothesis B: an adversary, or more than one, does real things that cost next to nothing. One email to twenty airports costs zero and moves the fighters of three countries. One manual password on a 2015 controller empties a hundred supermarkets in a night. Governments, which have long expected this phase and have written it into their documents, use the incidents to push a preparedness they already had on the agenda. It's called communicative opportunism, and it needs no director. And the media, which live on repetition, multiply the same web page into ten headlines. Three different trades, three different interests, nobody coordinating with anybody. It looks orchestrated because the interests converge, not because somebody aligned them.

And there's a third box the two-way scheme doesn't allow for. Call it hypothesis A': there is a single director, but it's the adversary. Fridges and emails are one package of low-cost hybrid warfare, calibrated to produce in democracies exactly the effect “the government is preparing us for something”. In that case the timing would be deliberate, and hypothesis B would be true for the governments and false for the attackers. It's cheaper than hypothesis A, because it doesn't require anyone to burn their own supermarkets, and more unsettling than hypothesis B, because the target isn't the stock but the trust.

The problem with hypothesis A is that it can't be refuted: any alarm confirms it, and the absence of alarms doesn't weaken it. That old genius Popper would say that a hypothesis which cannot be refuted is not a scientific hypothesis; I'd say, more simply, that it's a feeling. To keep it alive honestly you have to turn it into predictions that can fail.

What to watch carefully, from here to six months out

If hypothesis A is true, we should see: threats that are never attributed to anyone, or attributed vaguely and without names; claims like NoName's taken at face value without verification; preparedness campaigns that accelerate regardless of whether the incidents continue or stop. Careful, though: the first two would happen even if B were true and the investigations were simply slow or classified. The only prediction that truly tells A from B is the third: if the incidents fall off and Be Ready accelerates anyway, changes tone or finds new emergencies to cite, column A fills up for real. If hypothesis B is true, we should see: arrests with first and last names, like the 22 of the incendiary parcels; a public technical report on the controllers, with the addresses and infrastructure of whoever got in; and a drop in the British alarms once the media window closes and the GOV.UK page goes back to being a GOV.UK page.

Keep count. I will too, and if in six months the column that has filled up is the wrong one, I'll try to write it here.

References and further reading

· 📝 Content shared under CC BY-SA 4.0 · · 🦣 Mastodon · 📸 Pixelfed · 📬 Email · · ☕ Support this work on Liberapay

media — jolek78's blog

Be ready. Or maybe not?

The week

The radiator

The emails

The leaflet

Three actors, but no director?

What to watch carefully, from here to six months out

References and further reading

The fridges

The hoax threats

Be Ready

The precedents and the generals