At two in the morning, in a supermarket in Stockholm, the freezers decided they were saunas. By breakfast the shop was telling customers that "everything was destroyed". Down south in Sjöbo, another ICA store posted that its fridges and freezers had been hacked and set to 50 degrees.

It was not only Sweden. On Monday, chains in Belgium, Luxembourg, the Netherlands, Ireland, Finland and Estonia reported the same thing: cooling units quietly flipped into defrost overnight, with readings reported as high as 50C. Around 40 Delhaize stores were hit, says the BBC. Carrefour lost chillers in 15 Belgian shops, SuperValu in 13 Irish ones. Even Ikea's store in Mons had to pull food from its fridges. One Delhaize manager near Brussels put his loss at €100,000 of produce before counting the cost of closing.

If this sounds familiar, it should. Last month hackers did exactly this to as many as 700 French supermarkets, with losses estimated in the tens of millions. Europe got a full rehearsal, a month's notice and a detailed method. On Monday it failed the same test in seven more countries.

Nobody asked for money

Start with what this was not. There was no ransom note. Nobody claimed it. A cybersecurity researcher quoted by Reuters, SentinelOne's Tom Hegel, said the lack of any financial demand points to sabotage.

Nobody has said who did it, and this paper will not guess. But you do not need a name to see the pattern. Someone is pressing on Europe's food chain to see what gives, and doing it in a way that costs them almost nothing and costs shopkeepers a fortune. In August, according to the BBC, refrigeration at a number of American military bases also misbehaved; US investigators are now comparing notes with the French. A month after Paris opened a criminal inquiry and the prime minister set the national cyber agency on it, there is still no public answer. On the same Monday, Die Linke's group in the Bundestag had its mailboxes swamped by thousands of messages in minutes, origin unknown. The pattern is a continent that finds out about attacks from its shop windows.

EU food commissioner Christophe Hansen got the tone right. These attacks, he said, are "a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it". Quite. So what does Brussels' famous rulebook say about it?

The law stops at the warehouse door

Very little, it turns out.

The EU's flagship cyber law, the NIS2 directive, is meant to harden "critical" sectors. Food is on the list. But read the small print. It covers food businesses "engaged in wholesale distribution and industrial production and processing". Retail is not in it, as Finland's food authority spells out in its own guidance, unless a national government chooses to go further. The warehouse is critical. The factory is critical. The supermarket, the one place where 450 million Europeans actually meet the food chain, is not.

There is a second law, the Cyber Resilience Act, which will make connected products such as fridge controllers secure by design. It has been in force since December 2024. Its main obligations apply from 11 December 2027. That is a fine answer for the freezer you buy in 2028. It does nothing for the thousands already screwed to shop walls.

Brussels loves to tell the world it leads on regulation. Here is the cost of that boast. The paperwork protects the parts of the chain that are easy to list. The attackers went for the part nobody listed.

The fix is a screwdriver

The really damning detail comes from the industry itself.

The Belgian firm that runs Delhaize's refrigeration, Sabcobel, says it has been working since the French attack to close "this vulnerability", but the units needed physical modifications, not just software updates. Its chief executive told Belga the simplest cure is to run the fridges over a secure connection, and that "most" of its customers switched after France. Danfoss, whose controllers were the main target in France, says it found the flaws last year and had "long recommended" updates. Sweden's cyber chief now says his country has "quite a lot of exposed operational technology devices".

Read that again. The vendor knew. The customers were told. The method was public. And thousands of controllers, according to one security firm, were still reachable from the open internet after the French attack. "Most" switched. The rest got Monday.

This is not a failure of law. It is a failure of nerve and of housekeeping, by companies that skipped the boring fix and by national agencies that did not make them do it. Europe does not need a new directive on fridges. It needs someone with authority to say, by Friday, every one of these units comes off the open internet or the shop turns it off.

Less paper, more plugs

There is a temptation, every time something like this happens, for Brussels to promise a framework, a task force and a consultation running into 2027. Resist it. The people who flipped those switches did not wait for a trilogue.

Three things would help this week. Name the exposed models and their owners, so that "most" becomes "all". Have national cyber agencies order exposed controllers offline, and get them that power where they lack it, rather than just "monitoring the incident". And when the French inquiry has an answer, say it in public, whoever it embarrasses.

A continent that cannot keep its frozen peas frozen is not ready for the harder attacks. The good news is that this one has a cheap cure. Unplug it.