Cyberattacks targeting supermarket refrigerators across Europe have been claimed by two pro-Russian hacking groups, a direct challenge to Kremlin denials of involvement. The incidents, which caused temperatures to spike by dozens of degrees and resulted in tens of millions of euros in damages, have underscored the extreme difficulty of definitively attributing such attacks. reported that while the Kremlin dismissed the accusations as baseless, European officials describe the incidents as a deliberate attempt to disrupt the food supply chain.
The attacks unfolded on November 2 in the United Kingdom, Germany, Belgium, Estonia, and Finland, where supermarket refrigeration systems were compromised. A similar attack had hit French retailers on October 12. On November 4, France’s national blood service, EFS, confirmed it was also targeted, with cyberattackers altering the temperature settings in its cold storage rooms. The EFS attack has not yet been claimed. Investigations into all incidents are ongoing.
Attribution: A Complex Digital Investigation
“Attribution is first the result of a process of study and analysis, based on precise elements that allow us to characterize the actors who carried out this type of attack,” said General Didier Tisseyre, former commander of French cyber defense from 2019 to 2022. “It’s like a police investigation: a crime has been committed and you have to find its author. Who benefits? What weapons were used? What is the environment? Is there any DNA?”
However, the general explained that the complexity of cyberspace makes this process exceptionally difficult. Attackers exploit vulnerabilities and use fragments of code that can be traced back to them, but which can also be recovered from others. This makes their identification very arduous, as it is difficult to reconstruct the chain of connections: compromised computers, servers, fake accounts, real accounts, and individuals whose identities have been stolen.
The investigation relies on a combination of elements derived from knowledge of attackers’ methods and tools, known as “cyber interest intelligence.” Once a technical characterization is made—complete with its inherent uncertainties—the question of attribution arises. In France, this is a political act that carries significant weight. Once an autonomous group or one linked to a state is identified, the consequences must be determined: how does one respond? Through cyber actions, diplomacy, economic measures, or legal channels? Do national or international jurisdictions get involved? What evidence can be presented?
The Lengthy Process of Cyber Investigation
The time an investigation takes is variable but is typically very long, mirroring the preparation phase of a cyberattack itself. A cyberattack requires extensive preparation, as attackers must identify vulnerabilities and build a strategy. General Tisseyre used the analogy of a bank robbery: attackers first scout the location, identifying security cameras and alarm systems. They then assess security measures and vulnerabilities, both technical and human. The attacker constructs an attack process, potentially pre-positioning small, discreet pieces of code hidden within the machines. At a certain point, they trigger the attack, either to steal data or to cause malfunctions, such as the temperature variations seen in the supermarket attacks.
After the attack, specialized teams examine the system, just as investigators would at a crime scene. They search for fragments of code that were placed, how they were triggered, whether they were erased, who connected to the system, when, how, and from which IP addresses. A significant portion of internet traffic consists of invisible technical exchanges between machines and software, which provides little useful information. Similar to protecting a physical building, while there are cameras and intrusion detection systems, these devices do not cover everything. Some things remain unseen.
After an attack, victims are advised to disconnect their computers or servers from the network but, most importantly, not to delete anything. Responders must preserve the “crime scene” to ensure the evidence remains valid for legal purposes. The analysis time is proportional to the preparation: it is measured in days, weeks, or even months, not hours.
Sharing Attack Intelligence Between Agencies
Following an attack, coordination begins between technical bodies. France’s national cybersecurity agency, Anssi, has partnerships with its counterparts in other European countries to understand attacks. A framework also exists at the level of Europol, involving the French cyber prosecutor’s office, with information exchanges. There is also coordination in advance, where these organizations stay informed of the operational methods and means of identifying attackers. This identification is done through “signatures,” similar to antivirus software but more advanced, and through reference lists of IP addresses of servers identified as being used by attackers.
The difficulty lies in identifying the actors behind the equipment: who manages these systems remotely? The manufacturer, a service provider, a trusted third party? A broad cartographic view is needed to trace these connections and feed the cyber interest intelligence. “It’s a complicated investigation that is difficult to conduct alone,” General Tisseyre stated. During his tenure leading cyber defense for the armed forces, he said they had privileged partnerships with their military counterparts on knowledge of the means used by strategic competitors.
The State vs. Non-State Actor Dilemma
If the link to the pro-Russian groups is confirmed, it would have significant implications for attribution and the response to the attack. In its cyber defense doctrine, France has defined that if a state carries out an illegal attack on state or corporate systems causing damage, it can be considered an armed aggression.
“The question is therefore to know who is attacking us: is it a state or not? Then, how did they do it? Did we leave the door open, or did they force it? What are the damages?” the general explained. Some people willingly sell their services to cybercriminal groups or states. Others believe they are participating in something else and are not fully aware they are part of an attack. The different nature and objectives of these actors make a considerable difference in the attribution process.
France’s Framework for Response
Regarding what France authorizes in terms of response, General Tisseyre was not specific. “The principle is to define in advance the range of possible responses,” he said. “The idea is to have highly specialized expertise to identify the traces left by a cyberattacker and analyze them.” France has established the C4, the Cyber Crisis Coordination Center, an entity created in 2018 that brings together all state services in the field of cyberdefense. These entities work together to analyze and identify measures for self-defense within a legal framework.
When asked to identify the most aggressive actors in these cyberattacks, the general declined to name a specific country. “But state actors are today particularly uninhibited and use all the means at their disposal, both information and computer-based, to carry out hybrid attacks against other countries,” he said. “The use of criminal or individual proxies allows them to distance themselves from these attacks, and even, with a certain hypocrisy, to pretend to help us.”
What is Still Unknown
While the attacks on supermarket refrigerators and the French blood service have been confirmed and claimed by some groups, no European authority has yet officially confirmed the state-sponsored nature of the attacks. The investigations are ongoing, and the full scope of the damage and the definitive identity of the command structures behind the attacks remain unknown. The question of whether these incidents will be officially classified as acts of aggression, and what form a potential response might take, is still pending the outcome of these complex inquiries.
,autocrop(1200:630))
