ROME — Italy has confirmed cyber intrusions targeting refrigeration systems used by supermarkets and food distributors, joining a growing list of European countries affected by attacks capable of disrupting food storage and supply chains.
The government says the impact has been “limited,” with no evidence of food safety risks. But the incidents have prompted a coordinated response involving intelligence agencies, cybersecurity authorities and law enforcement.
Why it matters: The attacks expose a vulnerability in Europe’s civilian infrastructure. Internet-connected industrial refrigeration systems can be remotely manipulated, potentially compromising food supplies without sophisticated malware.
- Similar incidents have been reported in Belgium, Luxembourg, Ireland, the Netherlands, Latvia, Finland, Sweden and Germany.
- European authorities are investigating possible connections, while cybersecurity researchers point to previous operations claimed by pro-Russian hacking groups.
- No official attribution has been made, and there is no evidence that the latest incidents were coordinated by a single actor.
Italy moves to contain the threat. Prime Minister Giorgia Meloni’s office issued a statement following a meeting involving today Cabinet Undersecretary Alfredo Mantovano, Agriculture Minister Francesco Lollobrigida, intelligence officials and the National Cybersecurity Agency (ACN).
- Palazzo Chigi confirmed unauthorized access to refrigeration systems but stressed that no public health risks linked to food thawing had been identified.
- On the ground: Italy’s Postal and Communications Police are investigating incidents in Sicily and Emilia-Romagna. Employees at a Coop supermarket in Palermo described a “surreal situation.”
The ACN also received an incident notification from a Tuscany-based catering company and detected a suspected attack against an Emilia-Romagna frozen-food producer.
- The agency is coordinating with the Carabinieri’s specialized food safety unit (NAS) to address potential anomalies.
- It has urged supermarket chains, logistics companies and refrigeration operators to immediately review their cybersecurity protections.
- Recommended measures include isolating industrial control systems, securing remote access through VPNs and multifactor authentication, and reviewing privileged accounts.
The government’s message: There is no reason for public alarm, but Italian institutions remain on high alert.
Zoom out: A European threat, with an uncertain origin. The European Commission has already held two meetings to assess the incidents, which have affected refrigeration infrastructure across several member states.
- European Commissioner for Preparedness and Crisis Management Hadja Lahbib warned that cyber threats are increasingly reaching ordinary civilian services, including supermarkets.
- “What once seemed like science fiction is now part of our everyday security reality,” she said at the European Civil Protection Forum in Brussels. “We are not at war, but we are not at peace either,” Lahbib added, describing a dangerous security gray zone.
The Russian question: Research published on October 22 by Vedere Labs, the research division of US cybersecurity company Forescout, documented more than 20 claimed attacks against industrial and commercial refrigeration systems since the beginning of 2026.
- Two pro-Russian hacking groups featured prominently:
- Z-Pentest Alliance, which claimed ten attacks in a single day on April 26.
- NoName057(16), previously associated with disruptive campaigns against Western infrastructure.
- Targets included supermarkets, agricultural warehouses, wineries and food-processing facilities in Italy, Spain and other European countries.
- How it works: Attackers exploit exposed industrial control interfaces to remotely modify temperatures, defrost cycles and other refrigeration parameters. The resulting disruption can spoil food products and generate economic losses without requiring advanced malicious software.
The caveat: Forescout’s findings document relevant precedents, but do not establish responsibility for the latest incidents.
- Rafe Pilling, director of threat intelligence at Sophos, told The Guardian that the attacks could reflect either a state-backed demonstration of offensive capabilities or the actions of an independent hacker.
- SentinelOne researcher Tom Hegel similarly noted that limited forensic traces can make it difficult to distinguish opportunistic intrusions from intelligence-linked sabotage.
Hybrid warfare enters Italy’s political debate. Giovanni Donzelli, vice president of Italy’s parliamentary intelligence oversight committee, COPASIR, described the incidents as evidence of an ongoing hybrid conflict.
- “Hybrid warfare is not declared. It is already happening,” he said, arguing that investments in cybersecurity and defense are essential to protecting citizens and everyday economic activity.
- Deputy Prime Minister Matteo Salvini took a more cautious position on possible Russian involvement, saying attribution was a matter for intelligence agencies. “If it rains tomorrow, it won’t be the Russians’ fault,” he remarked.
The bigger picture: Why this matters beyond supermarkets: The incidents illustrate how connected industrial technologies can turn relatively inexpensive cyber intrusions into physical disruptions.
- Food distribution depends on refrigeration equipment, logistics platforms and remote maintenance systems, creating an extensive attack surface that is difficult to monitor.
- For European governments, the challenge extends beyond identifying the perpetrators. Protecting decentralized civilian infrastructure is becoming an increasingly important dimension of national resilience.
The bottom line: Italy reports no immediate public health emergency, and the attackers’ identities remain unknown. But the European pattern highlights a broader security concern: essential civilian services can be disrupted through vulnerabilities that require relatively little technical sophistication to exploit.
