Hackers crippled refrigeration systems at supermarkets across seven European countries overnight, spoiling food and starting fires — and the same weak points exist in American supply chains while Washington sends billions abroad.

The attacks hit stores in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden. Hackers seized control of internet-connected cooling units and cranked temperatures to 50 degrees Celsius (122 degrees Fahrenheit), according to multiple retailers and technology suppliers. No one has claimed responsibility. The incident mirrors a similar attack in France last month that caused tens of millions of euros in losses at up to 700 supermarkets.

Stephan Moelans, CEO of Belgian refrigeration company Sabcobel, confirmed the units' evaporators were switched to defrost mode. "It's a cyber-attack, there is no other reason," Carrefour spokesperson Mich Vergauwen told Agence France-Presse. An ICA store in Sjöbo, Sweden posted that its freezers were broken "due to a 2am cyberattack" and that "everything was destroyed." At an Ahold Delhaize store northeast of Brussels, shoppers found empty shelves and a sign reading: "Due to cyberattacks, there will be no products on the refrigerated or freezer shelves."

The European Commission called it a reminder that "digital threats can increasingly affect citizens' everyday lives." John Billow, head of Sweden's national cybersecurity centre, told Reuters the country has "quite a lot of exposed operational technology devices" that need patching.

Here is where the framing diverges. NBC News and The Guardian both tied the attacks to "broader security fears" and "hybrid warfare" stemming from Russia's invasion of Ukraine, with The Guardian pushing hardest on the government-sponsored attack angle. Al Jazeera added the Iran-United States war to the list of concerns. None of the three outlets offered evidence linking any state actor to these specific attacks. No intelligence agency has assigned blame. No group has claimed credit. The Russia framing is inference presented as context — a journalistic habit that papers over the actual vulnerability: decades of connecting critical infrastructure to the internet with minimal security.

The real story isn't who pulled the lever. It's that the lever exists at all. Refrigerators, heating systems, security cameras, and alarm networks can now be monitored and controlled remotely — and across Europe, the patching hasn't kept pace. The same is true in the United States.

Congress has approved well over $100 billion for Ukraine while domestic infrastructure — power grids, water systems, food supply chains — runs on the same class of exposed operational technology. A cyberattack on American grocery distribution would produce the same spoiled food, the same empty shelves, the same fires. The difference is there would be no European ally writing us a check.

The Ahold Delhaize chain, which operates in the Netherlands and Belgium, reported a similar incident to Dutch police just last month. SuperValu in Ireland said 13 of its 223 stores were hit. Coop Sweden confirmed six stores affected. The scale is growing.

Nobody in Washington is asking what happens when this reaches American shores — or whether the money flowing overseas should first secure the systems that keep Americans fed.