European Commission President Ursula von der Leyen announced Monday that the EU will help finance some Black Sea security costs after attacks on commercial shipping — blamed on Russia — even as the main diplomatic push to end the crisis unfolds elsewhere.

“Threats, attacks and incursions are rising off the coasts of the Black Sea,” von der Leyen said at the start of her visit to Romania.

In response, she said the bloc will “fast track the work on the Black Sea Maritime Security Hub, with a clear timeline for completion and dedicated funding of €50 million.”

She also announced an additional €10 million in EU cash for Romania’s search-and-rescue operations. The sums are tiny compared to the €16.7 billion Romania is getting under the EU’s SAFE arms loans program.

The hub, announced last year, is a joint control center to be run by Romania and Bulgaria and is expected to be fully operational by the end of the year.

It aims to monitor maritime activity in real time and safeguard vital infrastructure such as undersea power and communication cables. It would offer both countries a unified view of the sea and sky, helping them detect threats before they strike.

Monday’s announcement follows weeks of mounting violence on the Black Sea. Since early October, at least nine ships have been struck in the exclusive economic zones of NATO and EU members Romania and Bulgaria; four were sunk, and 34 sailors are dead or missing.

Other ships have been hit off Russia’s shores.

Both Romania and Bulgaria raised the issue at last month’s meeting of EU leaders and are pressing for more security support. However, while Romania has blamed Russia, Bulgaria has stopped short. Von der Leyen is set to visit Varna, on Bulgaria’s coast, on Tuesday.

Meanwhile, the U.S. is steering talks on a Black Sea ceasefire and an agreement on safe passage, with Secretary of State Marco Rubio saying Washington is reviewing proposals from Turkey forwarded in late October and is “open” to ideas from India.

An agreement would not end the conflict, Rubio said, but it would “solve a unique aspect” of it by easing the spillover on food security for vulnerable nations.

EU foreign policy chief Kaja Kallas said on Oct. 21 that the bloc is working with Turkey, India and food-importing countries in Africa and other regions on a freedom-of-navigation deal. Ukraine has agreed to such an arrangement, she added, but Russia has rejected it.

Von der Leyen said the EU backs Ukraine’s call for a Black Sea ceasefire, referring to “the peace talks taking place in Abu Dhabi tomorrow with European presence.”

Commission chief spokesperson Paula Pinho gave no details on the proposals or the EU’s role. She noted a “common interest” in resolving disruptions, but declined to comment on the intentions of Turkey or the U.S.

Asked whether he foresaw a possible breakthrough this week, Ukraine’s Agriculture Minister Taras Vysotskyi was pessimistic. He said that Kyiv is “preparing to keep our farmers operating without access to the deep-water Black Sea ports for the long term.”

The Black Sea matters to both sides in the war.

The ports of Ukraine’s Greater Odesa region are main channels for its exports, including steel, iron ore and grain, and they bring in billions of dollars. Several ships hit in EU waters were carrying Ukrainian grain.

Most of Russia’s grain exports also leave through Black Sea ports such as Novorossiysk, a major oil export hub, along with Tuapse.

Other countries are deeply invested, too. Near Novorossiysk, the Caspian Pipeline Consortium terminal, partly owned by U.S. oil giants Chevron and Exxon, handles about 80% of Kazakhstan’s crude exports.

Turkey has suffered the most ship attacks, and tankers headed for Georgia have also come under fire.

Agnes Rønberg contributed reporting.

BRUSSELS — The European Commission will assess how well supermarkets are prepared to handle cyberattacks after refrigerators in dozens of stores across at least six EU countries were taken offline.

EU Agriculture and Food Commissioner Christophe Hansen told POLITICO that the attacks would be discussed at the next meeting of its Security College to assess retailers’ contingency plans and their ability to respond to incidents.

“Europe’s food supply chain must be prepared for new and evolving threats,” Hansen said. “The repeated cyberattacks on supermarkets are deeply concerning, causing economic losses for retailers and empty shelves for consumers.”

The announcement follows dozens of supermarkets across Europe reporting disruptions to their refrigeration and freezing systems on Monday.

Incidents were reported in at least six EU countries — Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia — with some retailers reporting that refrigerator temperatures had suddenly surged to as high as 50 degrees Celsius.

Commission President Ursula von der Leyen set up the Commission’s Security College in March 2025 to discuss strategic developments and threats to the EU’s internal and external security.

The Security College format lets commissioners examine attacks beyond their immediate impact on retailers. It also places the disruptions in the broader context of Europe’s vulnerability to hybrid warfare, where attacks on essential supply chains can be used to undermine public confidence.

The Security College meets periodically, separately from the Commission’s regular weekly meetings. On Friday, the Security College discussed the timing of its next meeting, but no date has been set, although heads of cabinet attending the planning meeting agreed it should take place soon, according to an EU official granted anonymity to discuss the behind-closed-door gathering.

The Security College is chaired by von der Leyen and attended by all her commissioners.

The latest disruptions follow a series of cyberattacks in France in October, when hackers appeared to remotely manipulate refrigeration systems by activating their defrosting mechanisms, causing temperatures to rise sharply and food to spoil.

In October, Commission agriculture officials met retailers affected by cyberattacks to take stock of the situation as part of the EU’s food security contingency and preparedness efforts. “We must work at every level to strengthen our preparedness and resilience,” Hansen said.

The commissioner stressed that Europe’s food security is not at risk, but warned that these incidents exposed vulnerabilities in the food supply chain, with consequences for businesses, food waste and consumer confidence.

“These are a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it — a warning that we must take seriously,” Hansen said.

BRUSSELS — Refrigerators in dozens of supermarkets in at least five EU countries were out of service on Monday, local news outlets reported, in what appears to be a repeat of cyberattacks that hit French stores last month.

As of Monday afternoon, there were news reports of incidents affecting supermarkets in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia. 

Several store managers told local media that refrigerator temperatures suddenly spiked to up to 50 degrees Celsius. This mirrors the French incidents last month, in which attackers appeared to remotely manipulate the fridges’ defrosting mechanisms so that they overheated.

It’s not confirmed that the attacks are connected or used the same software vulnerabilities that hit French chains, though one supermarket spokesperson said the incident is a cyberattack “similar to the one in France.”

Ken Munro, a cybersecurity researcher, said in an interview that supermarkets should have disconnected their refrigerators and the devices used to monitor and remotely manage them from the Internet. “I don’t accept any other excuse … particularly in light of the earlier [attacks in France],” he said.

Inti De Ceukelaire, another cyber researcher, also said the incident suggests supermarkets did not take the necessary steps even after the France attacks. “It seems that some of them simply did not get patched, which is quite ridiculous,” he said.

Belgian media reported on Monday morning that temperatures in supermarket refrigerators had suddenly spiked, forcing them to throw food away. A spokesperson for the Centre for Cybersecurity Belgium said the agency is “closely” following the incident, adding that the attackers are unknown and that it “may never be possible to identify them.”

John Billow, director of Sweden’s National Cyber Security Centre, told POLITICO that there are “similarities” to the French incidents and that the agency is in touch with affected organizations. A European Commission spokesperson said it’s aware of the incidents and is using the EU-Cyclone network to coordinate and share information.

Following France

French supermarkets were hit with a wave of similar incidents in mid-October, when attackers targeted refrigerators by Danfoss, a Danish manufacturer of store fridges. Danfoss did not immediately respond to a request for comment. The attacks in France triggered a response from the country’s prime minister and its cybersecurity agency.

Belgian supermarket chain Delhaize alerted its store managers early on Monday morning of problems with refrigerators, and Belgian broadcaster RTBF cited a store manager as saying that the problems were due to a cyberattack like those in France.

A spokesperson for the company said it is aware of an “IT incident affecting the refrigeration systems in a number of Delhaize stores.” A spokesperson for Colruyt, which operates Spar stores in Belgium, said in a statement that fridges in “around five” Spar stores have been affected. “We are currently doing everything we can to resolve the issue,” they said, adding that no Colruyt stores have been affected. 

A Carrefour spokesperson confirmed that 15 of its 700 stores have been affected, and that none of its larger “hypermarket” stores are among them. All stores remain open, they said.

Stores in Sweden have also been hit. A spokesperson for supermarket chain ICA confirmed an “incident overnight affecting a small number of ICA stores operating outside ICA’s central network” which affected its fridges and freezers. 

A Coop spokesperson said seven of its 800 stores were affected but the situation, which is “contained and under control.” In one case, a refrigeration system began to generate heat, they said. Last month in France, the attacks caused at least one fire.

Like the public authorities, cyber researchers are looking for signs of who may be responsible. The fact that the attacks have happened again is evidence to suggest a hostile nation could be behind the attacks rather than young hacker pranksters, De Ceukelaire said. Munro, however, said he believes a “copycat” is behind Monday’s attacks.

“This won’t be the end of it,” Munro added. “There will be more.”

This article has been updated.