By Furkan Jussab | News & Politics
Yesterday I wrote about two weakened leaders and the weeks before the rules change. This is the second half of that thought, and it’s a different kind of piece. It isn’t about politicians. It’s about a handful of strange events from the last six weeks that I can’t stop noticing, and about whether they add up to something or are just a run of coincidences.
The usual caveat first, because I mean it. I’m not trying to be a doom-monger. I’m writing down observations. And I’m going to be stricter than usual about separating what is confirmed from what is my own reading, because this is exactly the kind of subject where it’s easy to see a pattern that isn’t there.
If you missed the earlier pieces in this run, they are We’re in World War Three, It Just Hasn’t Been Labelled That Yet, Nuclear Weapons Will Be Used Again: This Isn’t Fear-Mongering, It’s Where the Evidence Points, and Are the Governments Secretly Preparing for a Perfect Storm of Disasters?.
The Timeline
Here is what happened, in order.
21 September. Sky begins airing The Wargame, a four-part series in which real former politicians and officials sit in a crisis room and respond to a fictional Russian attack on Britain. Michael Gove plays the prime minister, Nicola Sturgeon his deputy, Penny Mordaunt the defence secretary, with General Sir Richard Barrons as Chief of the Defence Staff. The scenario starts with the killing of two RAF pilots, a cyberattack on the NHS and a suspected Russian spy ship near undersea cables, and goes on to what’s described as the biggest loss of military life in a single day since the Second World War. The scenario also involves a strike on Kaliningrad. Sky and the producers are clear that it is not a prediction.
Late September. The Russian embassy in London reacts. Reporting at the time said it warned of a response “including nuclear weapons” to the kind of action the programme depicted around Kaliningrad. That was a reaction to a television drama. I’d treat the exact wording with some care, since I’m relying on press reports of the statement, but the fact that an embassy felt the need to respond to a fictional scenario at all tells you something about the mood.
11 to 12 October. Overnight, hundreds of French supermarkets have their refrigeration hijacked. Remote attackers push the controllers into a forced defrost cycle while the stock is still inside. Reports describe temperatures reaching around 50°C in many units, with one Normandy store reported at 80°C. Some equipment catches fire and Paris prosecutors open an investigation. Estimates of the number of stores vary, from “hundreds” to up to 700 in some reports. The French prime minister asks the national cyber agency to investigate and coordinate with other European countries.
22 October. The UK government launches its “Be Ready” campaign, telling households to keep three days of water, food, torches and radios. I covered that and the wider wave of preparedness warnings in the perfect-storm article.
Night of 1 November. Two apps, on opposite sides of a war, send out fake nuclear alerts within hours of each other. More on that below.
1 to 2 November. A second wave of refrigeration attacks hits supermarkets in at least eight European countries, including Belgium, Sweden, Ireland, Estonia, the Netherlands, Finland, Portugal and Italy.
That is six weeks. Now let me take the pieces one at a time, because they are not equally solid.
The Alert App Hacks
This is the one that stopped me.
At about 10:47pm on Sunday night, Ukraine’s Air Alert app, the one millions of Ukrainians rely on to know when to run for shelter, sent out false warnings of a nuclear attack, radiation and chemical threats, and street fighting in Kyiv. Reporting on the Ukrainian message says it read, in effect, that a nuclear threat was coming across Ukraine, but “do not worry, the Oreshnik is incoming.” The Oreshnik is Russia’s new intermediate-range ballistic missile. The Air Force said fifteen minutes later that the app had suffered “hostile interference,” and that it isn’t part of military command systems.
About three hours after that, at 2:45am Moscow time, the Russian Emergencies Ministry’s app was hit. Russian state media said false alerts reached users in 33 regions, warning of nuclear warheads being launched, telling people to stock up on three weeks of food and shelter in their basements. The ministry said the attackers exploited a vulnerability in the app’s admin panel, and isolated the affected services.
Two things stand out. First, the target is psychological. A false alert doesn’t destroy anything. It frightens a population, and it tests how people react. Second, both sides were hit, the same night. That’s what makes it hard to read.
What I don’t know, and nobody has established:
- Who did it. There’s a claim of responsibility floating around from a group called Hitcore, but I can’t verify it and I wouldn’t rely on it.
- Whether the two hacks are connected. They could be the work of one party playing both sides, two separate groups, or a copycat inspired by the first. No evidence I’ve seen decides between those.
- Whether a state was involved. Nothing published says so.
One more detail, which I’ll present as a coincidence and not a conclusion. The Ukrainian attack came just before a local ceasefire around Oleshky, in the Kherson region, expired. That ceasefire was one of the few signs of cooperation in the war. Expected three-way talks this month are another. A fake nuclear scare at that moment may mean something. It may also just be the moment someone had access.
The Fridge Attacks
This one is easier to explain than it first appears, and that matters.
Investigators identified the weak point as refrigeration controllers made by Danfoss, with some Copeland and Dixell units also affected. Danfoss says most of the affected equipment was old product that no longer received security updates. The vulnerabilities were disclosed back in March 2025, and a patch for part of the range came in August 2025. Many of the devices were reportedly reachable from the internet and protected by default or weak credentials. In plain English, a lot of shops left a door open that the manufacturer had warned about, and somebody walked through.
That cuts both ways. On the one hand, it means this doesn’t need a state with a massive cyber unit. One security researcher quoted in the coverage even suggested it could be “kids messing around.” On the other hand, state actors certainly have the capability, and Belgium’s national cyber centre has said the perpetrators may never be identified. There is no proof of a link between the first wave in France and the second wave across Europe. It could be the same group, or it could be people who read the first story and tried the same trick elsewhere.
What I find notable isn’t the method, it’s the choice of target. Not a bank, not an energy grid. Food. Supermarkets are the last link in the chain between farm and kitchen, and a hack that destroys tonnes of chilled food and costs millions overnight is a demonstration of how thin that last link is. It’s the sort of vulnerability that lands differently when governments have just told people to keep a few days’ supplies at home.
The Wargame and the Warning
I want to be careful here, because it’s the weakest link in any chain.
The Wargame was filmed months ago and is a drama. It can’t have caused anything, and it didn’t reveal anything secret. Its value is as a mirror. It takes things British officials are openly worried about, such as cyber disruption, sabotage, drones, damage to undersea cables and whether Europe can react fast enough, and runs them to a worst case. The reaction from the Russian embassy is the interesting part, because it shows that Moscow reads even fictional scenarios as signals and answers in nuclear terms.
Taken alone, a TV programme and a diplomatic statement is nothing. I mention it because of how closely its imagined opening moves, cyberattacks and a threat to cables, line up with things I wrote about in the perfect-storm piece, and with the general direction of the government warnings.
The Case That It’s All a Coincidence
I’d be doing you a disservice if I didn’t give this as much room as the pattern argument, because it is a strong case.
- The hacks aren’t sophisticated. An app admin panel and refrigeration controllers with default passwords are the targets of opportunists, hacktivists and criminals, not just states.
- There’s no published link between any of the events. Not one agency has said the alert hacks, the fridge attacks and the political situation are connected. If I imply otherwise, I’m doing something the evidence doesn’t support.
- Pattern-spotting is what brains do. In a world with two wars, a closed Strait and a constant flow of cyber incidents, you can always find six events in six weeks that seem to rhyme. The test of a real pattern is whether it predicts something, not whether it looks neat afterwards.
- The preparedness campaign pre-dates all this. As I noted last week, Britain has had household guidance since 2024, and the new campaign was reportedly planned before the latest escalations.
- Cyberattacks on infrastructure have been rising for years. This may simply be the new normal, with occasional events that happen to land at a tense moment.
I find all of that persuasive. So why write this at all?
What I Actually Think Is Going On
Not that someone is running a script. My point is smaller, and I think harder to dismiss.
Whoever carried these out, and whatever their motives, each event demonstrates something about how fragile our everyday systems are. The warning apps can be turned against the people who rely on them. The shops can be made to destroy their own stock. And all of it happens while the actual wars continue and governments are quietly telling their citizens to prepare. Even if it is pure coincidence, that is a society whose nerves are being tested from every direction, and the effects don’t depend on anyone’s intentions. A false nuclear alert frightens people whether it came from a state, a gang or a teenager.
That’s why I keep calling these earlier pieces a blueprint of what might happen. I’m not saying these events are the thing I was warning about. I’m saying they look like the kind of thing I was warning about, and that deserves attention.
What Would Show They’re Connected, and What Would Show They’re Not
As with yesterday’s piece, I’d rather say what would change my mind.
Signs of a real link:
- An official attribution naming the same actor or infrastructure behind more than one of these incidents.
- A third and fourth wave, at an interval, against other essential services such as water, payments or transport.
- The alert-app hack repeating in other countries, especially NATO states.
- The attacks clustering around diplomatic milestones, such as the November talks.
Signs of coincidence:
- Arrests of opportunist or criminal groups.
- Investigators finding no common tooling or infrastructure.
- The incidents stopping once the vulnerable systems are patched or taken offline.
- A quiet few weeks with nothing similar.
If the second list is what we get, I’ll be the first to say that I read too much into a busy month.
Where This Leaves Me
Put the two pieces together. Yesterday, an argument about the political window. Today, a set of events that show how easily nerves can be rattled and how exposed the basics are. Neither is a prediction. Both are things I think are worth writing down while they’re happening, not after.
There’s a third question I haven’t answered, which is where I think all of this goes next, and who I think is most likely to take the biggest step. That deserves its own piece, and I’ll write it when the next few weeks have given me more to go on.
Have you noticed any of these events, or do they feel like a normal month to you? Let me know in the comments.
