Supermarket fridge cyber attacks: lock down exposed controllers

Short read

This post covers the wave of cyber attacks that remotely switched supermarket fridges and freezers across Europe into defrost on Monday, and the UK food businesses caught up in it.

The attackers didn't need anything clever. They found refrigeration controllers whose login pages were on the open internet, many unpatched or still on default passwords. You'll learn what happened, why it matters well beyond food retail, and the checks to run on your own connected equipment this week.

The supermarket fridge cyber attacks that hit Europe on Monday (2 November 2026) are a lesson every organisation with connected equipment should take seriously. Refrigeration controllers in supermarkets and food suppliers across at least ten countries were taken over remotely and switched into defrost, with temperatures in some stores reportedly reaching 50C, according to the BBC. Food had to be thrown away, and the UK wasn't spared.

This article explains what happened, how the attackers got in, and what security leads, business owners and MSPs should check now.

What happened in the supermarket fridge attacks

The BBC reports that supermarkets in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Germany and Sweden reported problems. Belgium was among the hardest hit, with around 40 Delhaize stores in Belgium and Luxembourg affected, and in Ireland 13 SuperValu stores were caught up in what owner Musgrave Group called a cyber incident.

It wasn't the first wave. Three weeks earlier, a similar attack disrupted as many as 700 French grocery stores, with food losses estimated in the tens of millions of euros. France's national cyber agency, CERT-FR, had already issued an alert on 12 October about widespread compromises of Danfoss AK-SM and AK-SC, Copeland XWEB and Dixell XWEB refrigeration controllers.

The European Commission described the incidents as "not isolated", and no one has claimed responsibility. Belgium's cyber security agency told The Record that "it may never be possible to identify" who was behind them.

The UK impact

The NCSC has confirmed it is aware of "a couple of instances where vulnerable technology had been exploited in the UK", and its staff worked through the night contacting organisations it could see had vulnerable systems exposed online, the BBC reports.

So far, the confirmed UK cases are in the food supply chain rather than supermarkets:

• Meat processors. The Association of Independent Meat Suppliers told Computer Weekly that refrigerators at three abattoirs were caught as "collateral damage". The fridges were empty at the time, so no meat was lost.
• A fresh produce wholesaler. Langridge Organic told The Grocer that six of its ten cold room control systems were hacked and set into a defrost cycle. The attackers also disabled the automated messages that would normally warn the business when a cold room left its safe temperature range.

The NCSC's director of operations, Paul Chichester, said the national impact is "minimal" at the moment. NCSC chief executive Dr Richard Horne was blunter about what it signals, describing it to Computer Weekly as "just the foothills" of what might come.

How the attackers got in

None of this needed a sophisticated exploit. The pattern across every report is the same:

• Management interfaces on the open internet. The Grocer reports that the web login pages engineers use to check temperatures and change settings were "readily found by hackers on the open internet", rather than being reachable only over a private connection.
• Known, unpatched flaws. According to a security note shared among AIMS members, Copeland XWEB firmware version 1.12.1 and earlier contained "severe authentication bypass vulnerabilities that allow hackers to take control without a password". The Record reports a firmware update had been available since August.
• End-of-life kit and default passwords. Copeland says the vulnerability affects discontinued, end-of-life supervisory controllers. Belgium's Centre for Cybersecurity Belgium points to unpatched firmware, exposed web interfaces and unchanged default vendor credentials. Italy's government said the businesses hit there were mostly using obsolete systems "with interfaces directly exposed to the internet and inadequate authentication mechanisms".

In other words, these were doors left open, often by a third-party maintenance provider who needed remote access and took the simplest route.

Why this matters if you don't sell frozen peas

It's tempting to read this as a supermarket problem. The NCSC doesn't. Dr Horne told Computer Weekly that businesses running manufacturing lines, heating controls, building management systems and other operational technology (OT) could be vulnerable too: "There are a huge amount of OT devices connected to the internet, and all organisations need to be looking for them."

Think about what's in your own buildings: building management systems, CCTV recorders, access control panels, HVAC controllers, UPS management cards, and anything an outside contractor "just needs to log into". Many of them were installed by facilities teams or suppliers, never went through IT, and don't appear on any asset list.

The Langridge detail is the one to dwell on. The attackers didn't only change the temperature. They switched off the alarm that would have told someone. If the only warning you have is the device's own alerting, an attacker who controls the device controls the warning.

What to do this week

Based on the guidance from CERT-FR, the CCB and the NCSC's advice on internet-exposed OT:

1. Find out what you actually expose. Don't assume your OT can't be reached from the internet. The NCSC warns that exposure often comes from misconfiguration, legacy connections or unmanaged assets. Check from the outside, not from the asset list.
2. Take management interfaces off the public internet. Remote access for engineers and suppliers should go through a secure VPN or protected network. CERT-FR says filtering by the supplier's IP address is acceptable only as a short-term emergency measure.
3. Patch firmware and change default passwords. If a device is end of life and can't be patched, plan to replace it. CERT-FR warns a factory reset alone isn't enough on an exposed, unpatchable device, because it will almost certainly be compromised again.
4. Check the configuration, not just the access. CERT-FR specifically advises reviewing defrost settings on refrigeration controllers. Attackers change settings quietly.
5. Talk to your suppliers. Ask every contractor with remote access how they connect, and check your contracts and insurance before cutting a supplier's data feed, as the CCB advises.
6. Monitor from outside the device. Watch for logins to OT management pages, connections from unexpected places and alerting that suddenly goes quiet, in tools the attacker can't switch off.
7. Sign up for the NCSC's free Early Warning service, which flags publicly exposed vulnerabilities on your internet-facing systems.

The fridge attacks worked because ordinary weaknesses sat in plain sight for months. The fix is just as ordinary: know what you have on the internet, close what shouldn't be there, and make sure someone is watching what's left. You can see how urgentic approaches each of those on our platform page.