Nobody Bought a Cyber Risk. They Bought Freezers. 

In October and November 2026, attackers manipulated Internet-connected refrigeration systems across Europe and the UK, in some cases pushing temperatures to 50°C. The incidents exposed weaknesses in equipment used to protect food and blood products, while the UK’s National Cyber Security Centre (NCSC) has warned that AI could make cyberattacks faster and more effective.

In brief: Cyberattacks affected refrigeration systems in more than a hundred shops across at least eleven European countries, three French blood-bank cold-storage sites and British food suppliers. For one family of controllers involved, the manufacturer had published a security fix in February 2026, alongside advice not to expose the equipment directly to the internet. The NCSC described the attacks as unsophisticated. Nobody bought a cyber risk. They bought freezers, and the risk came with them.

I was on my way to Barcelona for a new event I was covering. My videographer had come with me, and we spent much of the journey talking about the cyberattacks of the last few weeks, which have been arriving thick and fast. It was the freezers that got us going, because we both love food.

He told me there’s a saying. Nine meals from anarchy. Three days, and that’s it. It comes from the civil contingencies world.

And it struck me how I’ve walked past tens of thousands of supermarket freezers in my life without ever really thinking about what they were connected to. I’m not alone. Few people do. A supermarket freezer is furniture. It hums away at the end of an aisle, it keeps the peas frozen, and the only time you give it a second thought is when there’s a handwritten sign taped to the glass and the shelf behind it is empty!

But last month, somebody thought about them very hard indeed.

Hundreds of French supermarkets were hit through October, at a cost running into millions of euros. Some units were pushed to 50°C. Some melted. Some caught fire.

Then on 2 November, a butcher in Hove, in Belgium, lost about €15,000 of meat when someone reached the controls of his refrigeration and turned the temperature up. He wasn’t singled out. Refrigeration units in more than a hundred shops ran hot across at least nine European countries – Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. Delhaize, Carrefour, Colruyt, Coop, SuperValu, an IKEA in Mons.

Germany and Romania reported theirs the following day, taking the total to at least eleven countries.

The UK wasn’t spared but it may have got off lightly. Three meat suppliers belonging to the Association of Independent Meat Suppliers were attacked through Copeland XWEB supervisory controllers. Their spokesman, Tony Goodger, described his members as “collateral” because they happened to run the same software. None lost any meat.

At Langridge Organic, a London fruit and vegetable wholesaler, Managing Director Alex Pearce watched a fridge being switched remotely into defrost mode and pulled its network cable out. He told The Grocer he was “pretty sure that I interrupted a live hacking event,” and that it was “amazing how many parameters” the attackers had changed. Nothing spoiled, because somebody physically unplugged it.

The UK’s National Cyber Security Centre (NCSC)’s director of operations, Paul Chichester CMG MBE, said the national impact was minimal so far. Minimal is not the same as unaffected, and I’d still like to know why it was minimal. Were British estates configured differently, did we simply get lucky and have a wholesaler paying attention, or are more to come?

But the most consequential near miss may have been in France because on 2 November, three plasma cold-storage sites operated by the Établissement français du sang (EFS) were targeted through a supplier of their refrigeration equipment. Temperature and defrosting settings were manipulated to dangerously high levels.

Thankfully, monitoring detected the anomalies. Alarms sounded. Staff intervened and moved or secured the plasma in time. No blood products were lost, and no health consequences were identified.

Who was behind it?

No one really knows but two Russia-aligned groups, Noname057(16) and Z-Pentest, reportedly claimed the freezer cyber attacks on Telegram, saying they were exposing poor security practice. The posts have since been deleted, none of the material they claimed to hold has been published, and no government has formally attributed anything. Of course, Russia has denied involvement and that’s why we still have to treat it as unverified.

What some officials will say is more interesting. For instance, Chichester described the attacks as unsophisticated, exploiting vulnerabilities that have existed for a long time. Romania’s cyber security director, Dan Cimpean, also called the incidents in his country “semi-amateurish” and said he didn’t suspect a state actor.

Although no one has established whether the same hands were behind all of it, researchers looking at the pattern haven’t seen any signs of AI involvement.

But the fact remains… the capability on display was low, and the consequences were not. Food destroyed by the lorryload, fires started, and the cold chain holding blood products for transfusion interfered with. Disruption to essential services that people depend on every day. And, at a time when war in Europe already feels uncomfortably close, incidents like these bring the possibility of wider disruption much closer to home.

Attribution matters, but waiting to find out who did it will not make a single controller safer.

Here’s how it was possible

ANSSI, France’s cyber security agency, named the equipment – remote control modules in the Danfoss AK-SM and AK-SC ranges, and Copeland’s Dixell XWEB supervisory systems. Danfoss has said most of the affected units were older products no longer receiving updates. Copeland identified a vulnerability in controllers it has discontinued. A UK official described the French units as connected directly to the Internet with default passwords.

It turns out, the controllers behind the British cases were Copeland XWEB Pro units. In February, Copeland published a bulletin recommending firmware version 1.13, which it said addressed all previously identified vulnerabilities, and telling customers to make sure their devices were not reachable from the public Internet. Its words were…

“never expose the control system to the broader Internet.”

In August, Claroty’s Team82 published the detail – twenty-three vulnerabilities, twenty-one of them high severity, affecting version 1.12.1 and earlier. The fix was the same 1.13.

The attacks came in October and November, against Internet-exposed units.

They applied to one controller family rather than every system hit across Europe, and whilst I can’t tell you that patching would have prevented all of it, for these, the fix had existed for nine months, alongside written advice not to put them on the Internet at all.

So, who was supposed to install it? The retailer who owned the freezer, the contractor who managed it remotely, or the manufacturer who shipped it?

A fix that exists and never reaches the equipment is another failure at the join, and none of this will surprise anybody who works in operational technology (OT). Professor Awais Rashid of Bristol described the estate plainly in the same reporting – remotely managed, often by a third party rather than the retailer, frequently past end of life, reachable from the Internet.

I doubt many supermarket boards have ever discussed the attack surface created by their refrigeration estates. What they likely have done is approved an investment in equipment and operational efficiency, not an expanding network of remotely accessible controllers.

So back to the retailer who bought the freezers. The manufacturer who built in connectivity because connectivity sells. The maintenance contractor who took on remote monitoring because it’s efficient and because the customer asked for it.

Every one of those decisions is defensible on its own, and nobody owned the join between them, which is why, as I wrote recently, connections are where things break.

The NCSC’s warning

On 3 November, the NCSC published its Annual Review, marking its tenth year. What struck me reading it is how little of it is about cyberattackers.

Richard Horne , the NCSC’s Chief Executive, writes that the UK’s cyber resilience “is not yet where it should be,” with too many organisations vulnerable to attacks “that could, and should, be prevented.”

Then this…

“AI did not create these cyber security weaknesses; it revealed them. It exposed years of technical debt and the failure to implement even basic cyber protections, with technology and security investments too often deferred.”

The Security Minister, Dan Jarvis, went further in his own foreword. He says he was struck that…

“the core components of good cyber security remain exactly the same today as they did in 2016,”

with familiar and preventable weaknesses like unpatched software and password compromise still standing open.

The review proves the point with a trick I admired. It opens by describing Russian attacks on Ukrainian power generation, a massive breach of government personnel records, and UK telecoms and health sector ransomware, then tells you the year is 2015. Sandworm, the US Office of Personnel Management, TalkTalk.

TalkTalk. The breach Baroness Harding was taken through, and was still drawing lessons from in the House of Lords this September. Eleven years on we’re describing the same weaknesses in the same words.

Their summary of what 337 incidents taught them includes the line that sophisticated actors don’t have to be sophisticated to gain access, and notes that 88% of incidents at large organisations came from just four initial access vectors. None of that is new, which is the point.

Horne has since put the freezers in his own words. He called them “really just sort of the foothills” of what the UK’s NCSC is warning about.

What will AI be amplifying when it gets here?

The review also contains a deliberately pessimistic scenario, set in 2028, intended to show what happens if resilience fails to keep pace. Part of it reads:

“In 2028, there is more potential for AI to coordinate cyber compromise impacting the physical world due to the increased cyber-physical interface with more AI controlled robots, cloud controlled CNI and greater integration of cyber into physical (e.g. biological) labs.”

There’s an important distinction here. Supermarket refrigeration is not critical national infrastructure in the formal sense, and there’s no evidence that AI coordinated any of this. The scenario is specifically about AI doing the coordinating and that’s why I’m not saying their 2028 came true in 2026.

What I am saying is more specific, and I hope more useful. October, now referred to as Black October, showed us how much is already exposed – discontinued controllers, default passwords, a fix nobody installed, a continent’s worth of chilled food and three sites holding plasma.

That’s the foothills Horne was talking about, and it’s the baseline AI will be working from. What worries me is not whether AI makes attackers faster. It’s the condition of the estates it will arrive into.

What your board hasn’t calculated

Consider what happened on 2 November. Competing retailers, in different countries, under different regulators, with different security teams and different budgets, went down on the same day.

Whether the attacks were coordinated remains unclear. What is clear is that organisations across Europe were exposed by the same class of weakness.

The equipment varied, but the vulnerabilities were remarkably similar – remotely accessible management modules from several manufacturers, including older or discontinued products that were no longer receiving security updates. And that troubles me more than a single vulnerable supplier, because avoiding one manufacturer would not have eliminated the exposure.

The NCSC puts the general case better than I can, in a highlighted box in the review – organisations are increasingly reliant on suppliers and other trusted third parties for critical functions, and weaknesses in a supply chain “can expose them to risks beyond their immediate control.“

We’ve seen this happen without an attacker before, with the world’s biggest IT outage. In July 2024, a faulty CrowdStrike content update caused approximately 8.5 million Windows devices to crash, disrupting airlines, hospitals, banks and broadcasters around the world. Many of those organisations had chosen a very reputable security provider for entirely defensible reasons. Yet a single update exposed just how much critical infrastructure depended on the same technology behaving as expected. The incident was not a cyberattack. It was a reminder that shared dependencies can produce shared failures, even when everyone involved is trying to do the right thing. The concentration had grown across organisational boundaries, and no single organisation could manage its consequences alone.

However, there’s an important difference between the two incidents. CrowdStrike was one dependency failing everywhere at once, which an organisation performing a thorough risk assessment might at least have surfaced. But the freezer attacks were the same class of weakness appearing across different products from different manufacturers, which a conventional vendor-by-vendor review could easily miss.

The truth is, you very likely share more critical suppliers with your competitors than with your own subsidiaries. The same identity provider, the same cloud region, the same managed service provider, the same maintenance contractor with remote access to something physical. And as I argued when writing about maximum load, a fallback is only a fallback if it’s not carrying everybody else’s weight at the same moment.

Nine meals

My videographer’s saying has stayed with me since Barcelona. Nine meals. Three days. Perhaps it’s because on 22 October, while French supermarkets were still counting the cost, the UK Cabinet Office launched Be Ready, the first stage of a three-year campaign telling UK households to prepare to manage for three days without power, water, phones or the Internet. It names the threats in this order…

“From severe weather to cyber attacks, emergencies can disrupt the services you rely on.”

The UK is not alone. The EU has been asking its 450 million citizens to prepare for 72 hours of self-sufficiency since March 2025, and more than thirty countries now give similar advice.

Different governments, different working groups, arriving independently at roughly the same number.

Then, twelve days after the launch of Be Ready, the NCSC published its Annual Review. Its foreword was written by the same minister, Dan Jarvis, who observed that the core components of good cybersecurity are exactly the same today as they were in 2016, and that familiar, preventable weaknesses remain.

Now, I doubt those two publications were intended to be read together, but I think they should be.

Preparedness advice is not a prediction that the lights will be off for three days. It’s about coping with plausible disruption while help reaches the people who need it most. I think the campaign is sensible given the state of the world (cybercrime, climate change, geopolitics) as it is right now. But it’s interesting to see the direction responsibility is travelling. We’re asking households to prepare for the loss of services they’ve spent their whole lives assuming will work. Yet, how many of the organisations providing those services have tested the dependencies they themselves rely on?

Nine meals is a saying, not a scientific threshold. But the fragility it describes is real, and it’s not a margin anybody sat down and designed either. It’s what is left over once you add up decades of sensible, separate decisions about just-in-time delivery, centralised distribution and cold storage that somebody else looks after.

When you really think about it, the freezers are not really a story about freezers.

An organisation can make sensible decisions, hire good people, buy from reputable suppliers, pass its audits, and still be part of a system nobody understands well enough to keep safe. Good organisational cybersecurity does not automatically add up to collective resilience.

What questions should leaders ask?

Don’t start with everything. Start with systems whose failure could have physical consequences. For instance…

1. What is connected that nobody thinks of as technology? Refrigeration, building management, lifts, access control, HVAC and other equipment maintained remotely by third parties. Do you know what’s connected, who can access it and whether it’s included in your asset inventory?
2. Who owns each interface, rather than each box? Who is responsible for what crosses the boundary between your organisation and a supplier, what assumptions that connection relies on, and what happens when those assumptions fail?
3. What do our suppliers depend on that we also depend on? Assume your suppliers are well run. What infrastructure sits underneath them, and how widely is it shared? If that dependency failed across your sector, what would your recovery plan still assume was available?
4. Who has the authority to stop a connected system when its behaviour becomes unsafe? At Langridge Organic, the Managing Director disconnected a network cable. It worked, but intervention shouldn’t depend on one person noticing a problem and being close enough to act. Who can intervene in your organisation, and have you tested whether they actually can?
5. Have we ever rehearsed across the boundary? Can your team and your supplier’s team agree, at 2am, who is authorised to disconnect a system, and can they act without waiting for permission from a potentially compromised supplier?

What will anyone learn from the blood banks near miss?

What happened at the French blood banks deserves more attention than it has had, and France’s cyber security agency and its Health Ministry are investigating the EFS incident. The monitoring worked. The alarms fired. People understood what they were seeing and moved the plasma in time. Three sites were attacked through their refrigeration supplier, and the plasma was preserved.

That’s a near miss, and near misses are some of the most valuable safety data we have, because they tell you how close you came without charging you for the lesson.

But, I keep wondering how much control was available remotely in the first place. In a cold chain holding blood products, should there not be limits that a remote controller simply cannot override? Monitoring tells you when something has gone wrong but an independent safeguard can stop a compromised controller turning an incident into a physical disaster.

Now, I don’t know what protections were in place at those three sites, and I’m not suggesting there were none. That’s precisely why I want to know what the investigation will examine. Who got in matters, but we also need to understand which safeguards worked, which came close to failing, and what other organisations using similar equipment can learn from the incident.

An investigation into an intrusion is not a learning system.

Now I want to hear from you…

Can we really call ourselves cyber resilient without collective strength across the systems we all depend on? Join me on LinkedIn and tell me in the comments.

Sources

The refrigeration attacks across Europe

• Al Jazeera – Very cold war: Who’s attacking Europe’s supermarket freezers? (3 November 2026)
• Al Jazeera – EU urges action as Germany, Romania and UK report supermarket cyberattacks (4 November 2026)
• The Record – Second wave of suspected cyberattacks hits supermarket freezers across Europe (2 November 2026)
• The Record – British businesses caught in Europe-wide supermarket fridge attacks (3 November 2026), including comments from the NCSC and the Association of Independent Meat Suppliers
• Euronews – Cyberattack hits French blood banks but no samples compromised, officials say (4 November 2026)
• The Record – French blood service hit by Europe-wide cyberattacks on refrigeration (4 November 2026), including statements from the Établissement français du sang on monitoring, alarms and the preservation of blood products
• PBS NewsHour – Here’s what to know about another cyberattack on European supermarket fridges, including reporting on the affected controller families and the French authorities’ response
• Tom’s Hardware – Reporting on claims by Noname057(16) and Z-Pentest. The claims were subsequently deleted and remain unverified.

Vulnerabilities, manufacturers and operational technology security

• Copeland – XWEB PRO security bulletin (February 2026), recommending firmware version 1.13 and advising against direct internet exposure
• Claroty Team82 – Chilling Discoveries: Unpacking Vulnerabilities in Copeland XWEB Pro Controllers (9 August 2026)
• NCSC – Secure Connectivity Principles for Operational Technology: Principle 2 – Limit the exposure of your connectivity (14 January 2026), covering internet exposure, remote supplier access, obsolete systems and network segmentation

AI, cyber threats and shared dependencies

• NCSC – Annual Review 2026: The State of the Cyber Nation (3 November 2026), covering 1 September 2025 to 31 August 2026
• NCSC – Artificial intelligence and cyber intrusion (3 November 2026), assessing AI-enabled cyber threats through to 2028, including the exploitation of known vulnerabilities in legacy critical infrastructure
• Microsoft – Helping our customers through the CrowdStrike outage (20 July 2024)

National preparedness and resilience

• UK Cabinet Office – Prepare, official household emergency preparedness guidance associated with the Be Ready campaign launched in October 2026
• European Commission – EU Preparedness Union Strategy (26 March 2025), including the recommendation to develop guidance for a minimum of 72 hours of household self-sufficiency

Further reading: Cyber Survivability

Jane Frankland – Your Name Is on the Risk Register. The Decision Wasn’t Yours.

Jane Frankland – Cybersecurity Has a Design Problem. And We’re Blaming the Users for It.

Jane Frankland – Everyone Did Their Job. Nobody Did the Calculation.

Jane Frankland – Your Minimum Viable Business Has a Maximum Load. Do You Know It?