Hackers have tampered with refrigeration units at UK food businesses, including meat suppliers and a London fruit and vegetable wholesaler. In one case, attackers changed the settings on several cold units so that they would defrost for more than four hours at 150C. The UK incidents came to light a day after retailers in seven European countries reported that their supermarket cooling systems had been hit, and a month after similar attacks on supermarket fridges in France.
The National Cyber Security Centre (NCSC) has confirmed it is aware of related incidents affecting UK food businesses and is working with the organisations involved. Its director of operations, Paul Chichester, said the national impact was “minimal” and that the attacks were not AI–enabled. Instead, according to Chichester, they exploited vulnerabilities that had “been out there for a long period of time”.
No meat was lost, and staff at the London wholesaler intervened before stock was damaged — by physically unplugging the units’ internet connection at the wall. But the episode is a sharp illustration of a wider problem. Internet–connected equipment that was installed years ago, often with default passwords still in place, is now an easy target. The attackers did not need valuable data. They needed only a device they could reach and change.
What happened in the UK
The British Association of Independent Meat Suppliers said some of its more than 300 members had been affected after becoming “collateral” in the hack. No meat was lost. One company saw its cold units rise to as high as 100C, while two others reported units starting to defrost.
In London, the fruit and vegetable wholesaler Langridge Organic found that hackers had changed the parameters on several of its units, setting them to defrost for more than four hours at 150C. Managing director Alex Pearce and staff stepped in before any stock was damaged. They stopped the attack in the most direct way available: by physically unplugging the units’ internet connection at the wall.
Pearce said Langridge uses the same fridge control system, made by the US software company Copeland, that was involved in the earlier French supermarket incidents. He said the French attack had involved legacy technology connected to the internet with default passwords still in place. Copeland said it is talking to affected customers and has recommended software fixes.
The temperatures quoted are the figures reported by the businesses involved. Whatever the exact readings, the practical point is the same: a remote attacker was able to change how food–safety equipment behaved, and in at least one case the fastest way to stop it was to pull a cable.
The European picture
The UK incidents followed a wave of reports from across Europe. On Monday 2 November 2026, retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported refrigeration problems, with some units rising as high as 50C. Several companies confirmed they had been hacked. Similar attacks had hit French supermarket fridges the previous month.
The spread suggests an opportunistic campaign rather than a targeted one: attackers finding exposed refrigeration controls wherever they exist and changing their settings. The British meat suppliers’ description of themselves as “collateral” fits that picture. They were affected not because someone chose them but because their equipment was reachable.
Refrigeration controllers, heating and ventilation systems, door access panels, CCTV recorders and building management systems are often connected so that an engineer or supplier can check them remotely. If that connection is open to the internet and still uses the manufacturer’s default password, it can be found and changed by anyone scanning for it. The UK businesses in this story were lucky that staff noticed in time. Find out today which of your devices can be reached from outside, and who set that up.
How the attacks unfolded
The timeline below draws on the reporting. Where no precise date was given, the step is described rather than dated.
What the decoys revealed
Cybersecurity researchers often deploy deliberately exposed “dummy” systems, sometimes called honeypots, to study how attackers behave. In this case, researchers reported that attacks on decoy fridge controls displayed characteristics similar to malicious operations previously linked to Russia. That is an observation about patterns of behaviour, not a formal attribution, and nobody has publicly confirmed who was behind the attacks on UK and European businesses.
One cyberdefence firm, Lupovis, recorded 256 attempted attacks from 91 different sources against its decoy fridge controls between 20 and 30 October 2026. That is a ten–day window for a single set of decoys. It shows how quickly an exposed device is found and probed once attackers are interested in a particular type of equipment.
The number of different sources matters as much as the number of attempts. Ninety–one sources suggests this is not one isolated individual but a broader pool of activity — whether several groups, shared tools or automated scanning. For a business with an exposed controller, the question is not whether someone will find it, but how soon.
What the NCSC is saying
The NCSC’s messages contain both reassurance and warning. On the immediate incidents, Paul Chichester said the national impact was minimal, and that the attacks were not AI–enabled but exploited long–standing vulnerabilities. That is an important point: these were not sophisticated new techniques. They worked because old weaknesses had been left in place.
On the wider picture, NCSC chief executive Richard Horne described the fridge attacks as the “foothills” of an enlarging cyber threat. He said AI systems are increasingly surfacing vulnerabilities in IT networks that owners are unaware of or have neglected to patch. Our recent report on an AI system finding critical flaws in control software in under four hours shows how quickly that is moving.
NCSC chief technology officer Ollie Whitehouse added that everyday connected devices will become more susceptible to hackers, and that manufacturers need to make technology safer even if it costs more. That places responsibility on both sides: manufacturers to ship secure products, and businesses to configure and maintain the ones they already own.
Why connected equipment is such an easy target
Refrigeration controllers, heating and cooling systems, lighting controls and access panels share several features that make them attractive to attackers:
- Long lifespans. Equipment is often installed for ten years or more, with software that is rarely updated.
- Default credentials. Devices may still use the username and password they shipped with, sometimes printed in publicly available manuals.
- Remote access for convenience. Suppliers and engineers often want to check or adjust equipment remotely, so it is connected to the internet directly.
- Unclear ownership. The IT team may not know the equipment exists; the facilities team may not think of it as a computer.
- Physical consequences. Changing a setting can spoil stock, damage equipment or create safety risks, which gives attackers leverage even without stealing data.
Our earlier coverage of ransomware targeting building automation systems described the same pattern: attackers increasingly go after systems such as door access, HVAC and refrigeration because they are less protected than core IT, yet still offer leverage or disruption.
Which controls make the biggest difference
The chart below is our indicative assessment — not measured data — of how much each measure reduces the risk of a smaller UK business having connected equipment such as refrigeration controls tampered with remotely.
The top two bars address exactly what Pearce described in the French incidents: legacy technology connected to the internet with default passwords still in place. Removing direct internet exposure and changing default credentials close the easiest routes in. The independent temperature alarm earns its place for a different reason — it does not prevent an attack, but it makes sure someone notices in time to act, as Langridge’s staff did.
The bottom bar is the assumption this story overturns. Our report on why security through obscurity no longer works makes the same point: if a device is reachable, it will be found.
A readiness score card for connected equipment
The score card below rates common positions for UK businesses that run connected refrigeration, heating, ventilation, access control or similar equipment. It is a judgement framework for discussion with your IT and facilities teams, not an audit.
The emergency isolation row deserves attention. Langridge’s staff stopped the attack by unplugging the internet connection at the wall. That worked because someone knew which cable to pull and had the authority to do it. Every business with connected equipment should know how to disconnect it safely and quickly, and how to run it locally while the problem is investigated.
What it costs to secure connected equipment
The figures below are indicative ranges for a smaller UK business with one or two sites and a modest amount of connected equipment. They are planning estimates rather than quotations.
| Measure | Indicative one–off cost | Indicative ongoing cost | What it addresses |
|---|---|---|---|
| Discovery scan and inventory of connected devices | £500–£2,500 | Repeated annually | Finding equipment exposed to the internet or still on default settings |
| Changing default credentials with suppliers | £0–£500 | Password manager £3–£6 per user per month | Closing the easiest route reported in the French incidents |
| Network segmentation for building and refrigeration systems | £1,500–£8,000 | £50–£300 per month in management | Keeping equipment off the internet and away from office IT |
| Secure remote access for engineers | £500–£4,000 | £30–£200 per month | Replacing direct exposure with approved, logged connections |
| Independent temperature monitoring and alerts | £200–£1,500 per site | £10–£60 per month | Early warning if settings or temperatures change unexpectedly |
| Penetration test of external exposure | £2,000–£8,000 | Annually or after changes | Confirming nothing sensitive is reachable from outside |
| Cyber Essentials certification | A few hundred pounds upward, depending on organisation size | Annual renewal | Baseline firewall, configuration and password controls |
Against those costs sits the value of a cold store full of stock. For a food business, a single compromised freezer room could mean thousands of pounds of spoiled product, missed deliveries and difficult conversations with customers and food–safety inspectors. The affected UK businesses avoided losses this time because staff were quick. That is not a plan.
Exposed equipment versus managed equipment
Installed and forgotten
How many connected devices are run today
Managed like any other system
What the NCSC’s warnings point towards
Moving from the left column to the right does not require replacing equipment. It requires treating a fridge controller, a heating system or a door panel as what it is: a networked computer that can be attacked.
How ready are smaller UK businesses?
The gauge below is our indicative estimate of how well protected a typical smaller UK business is against remote tampering with its connected equipment. It is a judgement based on the patterns in the score card, not a survey figure.
A score of 27 reflects how often building and refrigeration systems sit outside normal IT management. Office laptops are patched and protected; the cold room controller installed by a refrigeration contractor five years ago is not. The NCSC’s comment that these attacks exploited long–standing vulnerabilities suggests that gap is widespread.
Contact the companies that installed and maintain your refrigeration, heating, ventilation and access systems and ask: is any of our equipment reachable directly from the internet? Have the default passwords been changed? Are there manufacturer software fixes we should apply? If the answers are unclear, ask your IT provider to check from the outside. And make sure staff on site know how to disconnect a device from the network safely if its settings start changing unexpectedly.
Analysis: the foothills of a bigger problem
The immediate damage from these attacks was limited. No meat was lost, Langridge’s stock was saved and the NCSC describes the national impact as minimal. It would be easy to treat the episode as a curiosity. That would be a mistake.
The attacks show that disruption, not data theft, can be the goal. A refrigeration controller holds no customer records or bank details, yet changing its settings can destroy stock worth far more than most data breaches cost a small business. Attackers who want to cause harm, extort a business or simply demonstrate capability have every reason to look at equipment like this.
They also show how old weaknesses compound. Chichester’s point that these vulnerabilities had been out there for a long time is the key detail. Nothing about this attack required novel technique. It required exposed equipment and default passwords — both of which are common, and both of which are fixable.
Richard Horne’s “foothills” warning looks ahead. As AI systems make it easier to discover vulnerabilities that owners have overlooked, the pool of easy targets becomes easier to find. Ollie Whitehouse’s call for manufacturers to build safer products, even at higher cost, is the long–term answer. In the short term, businesses have to manage what is already installed. Our report on the UK’s AI cyber defence warnings covers the broader shift.
The food sector deserves particular mention. Cold chain failures carry food–safety implications as well as financial ones, and many food businesses are small, independent firms with limited IT support. The British Association of Independent Meat Suppliers’ use of the word “collateral” captures the situation well: these businesses were not chosen. They were simply reachable.
At a glance
| Item | Detail |
|---|---|
| What happened | Hackers tampered with refrigeration units at UK food businesses |
| UK businesses affected | Some members of the British Association of Independent Meat Suppliers, and London wholesaler Langridge Organic |
| Most extreme setting | Units set to defrost for more than four hours at 150C at Langridge Organic |
| How it was stopped | Staff physically unplugged the units’ internet connection at the wall |
| Losses | No meat lost; Langridge’s stock saved before damage |
| European incidents | Retailers in seven countries reported problems on 2 November 2026; French supermarkets hit the previous month |
| Control system | Langridge uses the same Copeland system involved in the French incidents; Copeland has recommended software fixes |
| Reported weakness | Legacy internet–connected technology with default passwords, according to Pearce’s account of the French attack |
| Decoy research | Lupovis recorded 256 attempted attacks from 91 sources, 20–30 October 2026 |
| NCSC view | Minimal national impact; not AI–enabled; long–standing vulnerabilities exploited |
| Wider warning | NCSC calls the attacks the “foothills” of a growing threat to connected devices |
For related coverage, see our reports on ransomware targeting building automation systems, AI finding flaws in industrial control software, the end of security through obscurity, the NCSC advisory on routers targeted by state–linked hackers and the cyberattack wave hitting UK retailers.
Find out what on your network can be reached from outside
We discover and inventory connected equipment — refrigeration, HVAC, access control, CCTV — take it off the open internet, move it onto its own network segment and set up secure remote access for your suppliers.
Talk to us about Network Admin ServicesFrequently asked questions
Bring building systems under proper network management
Our network administration team treats refrigeration controllers, heating systems and access panels as the networked computers they are — segmented, monitored, patched and protected with strong credentials.
Talk to us about Network Admin ServicesThe UK businesses caught up in these attacks were fortunate that staff spotted the changes in time. The lesson for everyone else is to make sure luck is not the only safeguard: know what is connected, keep it off the open internet and change the passwords it shipped with.
Cloudswitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
