Commercial refrigeration attacks reach UK food suppliers as NCSC assesses minimal national impact
UK food suppliers were among businesses caught up in cyberattacks on commercial refrigeration controls across Europe on Monday 2 November 2026. The National Cyber Security Centre said it knew of a small number of UK instances where vulnerable technology had been exploited. Its chief executive said the agency had worked overnight to alert organisations that might be affected. Officials described the national impact as minimal at the time.
That assessment and the disruption reported by individual suppliers are compatible. A handful of cases can be serious for the businesses concerned without amounting to a national food emergency. The Guardian reported that no UK grocery chain had been directly affected so far, while the BBC, The Record and City AM reported that food supply chain businesses had been caught up.
The reported equipment was not a household smart refrigerator. It was commercial control gear used by shops, distributors and processors to monitor temperatures, change settings and manage defrost cycles remotely. The reporting does not establish that domestic appliances formed part of this campaign. UK Tech News said the incidents concerned commercial systems and did not show that household smart fridges were being targeted.
What happened in Europe
The European cases followed attacks on French supermarkets in October. Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported refrigeration problems on the Monday, according to The Guardian, with some systems reported to reach 50C. Sabcobel, a Belgian refrigerator maker, said evaporators had been switched into defrost mode, causing units to warm, the BBC reported.
The BBC reported that some affected retailers threw away spoiled food and cited losses of hundreds of thousands of euros. The earlier French wave was reported to have spoiled fresh and frozen food estimated to be worth millions. These are retailer estimates, not audited totals.
Reported temperatures vary: the BBC and The Guardian described cold units at one meat supplier reaching 100C, The Guardian reported 50C at some European shops, and Alex Pearce of Langridge described 150C. The figures may describe different equipment, readings or settings and have not been reconciled.
UK impact and response
The Association of Independent Meat Suppliers, which represents more than 300 businesses, said some members had been affected as collateral. The BBC reported that two members saw fridges begin to defrost and another saw cold units rise to 100C, but the units were empty and no produce was lost. The Record reported that three affected members had been attacked through vulnerable Copeland XWEB supervisory controllers.
Langridge Organic, a London fruit and vegetable wholesaler, stopped the interference by pulling its cold storage units’ internet connection out at the wall. Its managing director, Alex Pearce, said attackers had set units to defrost for more than four hours at 150C before staff intervened. The Guardian reported that Langridge uses the same Copeland control system involved in the French incidents. No stock was damaged.
Copeland is not the only controller maker named. UK Tech News, relaying France’s CERT-FR alert, reported that compromises affected Danfoss AK-SM and AK-SC controllers and Dixell XWEB equipment as well as Copeland XWEB. The alert warned against exposing management interfaces directly to the internet and recommended protected connections, security updates and default password changes. The underlying CERT-FR alert and a Copeland advisory were not directly available, so the product scope across every incident remains unresolved.
The technical picture
The most specific account concerns Copeland XWEB. A security note shared among AIMS members and reported by The Record said firmware version 1.12.1 and earlier contained severe authentication bypass vulnerabilities that allowed control without a password. The Record reported that a firmware update had been available since August 2026. A Copeland spokesperson confirmed that certain XWEB monitoring solutions had been affected and said it had re-communicated recommended patching and security protocols.
Those claims are not a published vendor advisory. The reporting gives no CVE identifier, formal severity rating or exact fixed version. The Record also reported that Claroty disclosed almost two dozen vulnerabilities in Copeland XWEB Pro controllers in August 2026. That is relevant context, but the evidence does not establish that one flaw explains every incident in Europe.
The NCSC’s comments point to an exposure and maintenance problem rather than a novel attack. Paul Chichester, its director of operations, said the incidents were not AI-enabled and used vulnerabilities present for a long time. In reference to the first French wave, the agency described the attacks as not sophisticated. That is consistent with internet-facing controllers, old firmware and weak credentials. It does not prove the precise cause of each case.
Exposure, attribution and the limits of the evidence
Exposure is extensive. City AM reported that researchers identified more than 800 refrigeration interfaces associated with UK retailers reachable over the public internet, while noting that exposure does not mean a system can be hacked. Bridewell, a security firm, said its research found more than 6,000 refrigeration management panels from a single manufacturer exposed online worldwide. Those figures describe the size of the surface, not the number of victims.
No group had claimed responsibility. British authorities said they had not attributed the incidents, and a spokesperson for Belgium’s cybersecurity agency said identification might never be possible. Honeypot research offers a lead, not an attribution. Lupovis recorded 256 attempted attacks from 91 sources between 20 and 30 October against decoys resembling Danfoss fridge controllers. Most authentication attempts used default credentials, The Guardian reported.
Xavier Bellekens of Lupovis said the probing infrastructure overlapped with infrastructure previously associated with Russian-linked malicious operations, but that the firm could not identify a group. The observation concerned decoys, not confirmed attacks on production equipment. That overlap is not evidence that a Russian-linked actor carried out the attacks.
What food businesses should do
The practical response is less about one patch than removing unnecessary reachability. CERT-FR’s relayed advice is to take management controls off direct internet access and use a protected connection such as a VPN for remote access. Businesses should install supported updates, replace or isolate unsupported controllers, change default and shared credentials, remove unnecessary accounts and use multifactor authentication where supported. A factory reset alone does not remove an underlying vulnerability.
Independent temperature monitoring and alarms can help staff detect abnormal conditions without relying solely on the controller. If interference is suspected, involve the refrigeration contractor, cybersecurity team and food safety lead. Preserve logs, hold stock, and assess temperature history before release. Restoring a controller does not prove the food is safe.
Food safety cannot be judged from the setting alone. UK Tech News noted that an altered defrost setting does not establish that food reached that temperature. Businesses need actual exposure records and reliable monitoring data. The Food Standards Agency guidance cited in the same report gives 0C to 5C for a domestic fridge and around minus 18C for a freezer; those are domestic benchmarks, not a complete commercial standard.
The policy gap
AIMS is urging the government to give the food sector a stronger place in Britain’s critical national infrastructure designation. The Record reported that no individual food sector assets are currently designated as critical under existing legislation, and that the sector is not included in the forthcoming Cyber Security and Resilience Bill, which would require essential service operators to maintain appropriate security measures, with fines of up to £17 million or 4% of global turnover for serious failures. The wider question is whether voluntary guidance is enough for such equipment.
For households, the evidence supports a narrower conclusion. This campaign has not been shown to target ordinary smart fridges. Connected appliances still benefit from changed default passwords, prompt updates, disabled remote access where unnecessary and attention to security support periods. An unexpected rise can have an ordinary mechanical cause, so check with a separate thermometer and a qualified engineer.
For food businesses, the open questions are immediate. How many exposed controllers remain online? Have available firmware updates been applied? Do the October French incidents and November European cases share a perpetrator or only a method? The reporting does not answer them. The NCSC’s minimal assessment describes national scale, not the severity for a business that finds its stock warming.
Reachable is not the same as compromised, and this story keeps the two apart: hundreds of refrigeration management interfaces visible from the public internet describe a large surface, not a list of victims. Telling one from the other is a working skill. It begins with how a networked service becomes visible at all, what a management interface is built to accept, and why a device that answers on the network has told you only that it is there. Networking and internet vulnerabilities are the areas that turn that reasoning into habit. If you would like to work through those ideas yourself, explore The Hack Academy’s online cybersecurity training programme, where networking and internet vulnerabilities are listed subject areas and self-paced learning sits alongside practical exercises and theory.