Supply ChainAnalysis

Fridge hacks reach UK food suppliers: what cold-chain buyers must check

Hackers raised fridge temperatures at food businesses across Europe and have now hit UK suppliers. Buyers should test cold-store contracts and remote access.

By Procupy News DeskPublished 4 Nov 2026, 7:13 AM IST5 min readSource: BBC News

In 60 words

Hackers raised fridge and freezer temperatures at food businesses in seven European countries on 2 November, after a French attack on 12 October. UK food suppliers have now been hit, the NCSC said, though impact was minimal. Entry was often via factory-default passwords on internet-facing controllers. Buyers should check cold-store contracts, credentials and who carries spoilage risk.

Key points

The NCSC said on 3 November it was working with UK food suppliers hit by the refrigeration attacks, and that the impact was minimal¹
Retailers in seven European countries reported incidents on 2 November, with thermostats pushed to 50C in some stores²
Lupovis logged 256 attempted attacks on fake Danfoss controllers from 91 sources between 20 and 30 October, mostly using factory-default logins¹
Property claims are being notified over the French losses, and the cause of loss will decide which policy pays³

Attackers have raised temperatures in refrigeration systems at food businesses across Europe, and the campaign has now reached UK food suppliers. The UK National Cyber Security Centre said on 3 November that it was working with the affected companies. Its director of operations, Paul Chichester, said: “We’re aware of those incidents in the UK, and obviously we’re working with the affected organisations. We’ll keep monitoring that. At the moment, the impact is minimal.”¹

Retailers in seven European countries reported refrigeration problems on 2 November, with thermostats pushed as high as 50C in some stores². Portugal’s Intermarché group confirmed seven affected stores a day later⁴. The wave followed an attack in France on 12 October. Hackers seized control of cooling units in as many as 700 supermarkets there, and losses were estimated in the tens of millions of euros^5, 2.

In the UK, the British Association of Independent Meat Suppliers said some of its more than 300 members were hit as “collateral”¹. It said no meat was lost and that the affected units were empty. One meat supplier saw its cold units rise to up to 100C, and two others reported units starting to defrost¹. London fruit and vegetable wholesaler Langridge Organic had unit parameters set to defrost for more than four hours at 150C. Staff pulled the internet connection at the wall before stock was damaged¹. No UK grocery chain has been directly affected so far¹.

Christophe Hansen, the EU food and agriculture commissioner, called the incidents “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”².

Which systems are exposed

Two controller suppliers are named in reporting. Copeland, a US software company, made the fridge control system involved in the French incidents¹. Danfoss, the Danish manufacturer, supplied most of the controllers pirated in France, and its system was used by the Swedish chain ICA^2, 5.

Both waves leaned on internet-facing management software. The French attack involved legacy technology connected to the internet with default passwords¹. Lupovis, a cyberdefence firm, set up fake Danfoss controllers as honeypots and logged 256 attempted attacks from 91 sources between 20 October and 30 October¹. Most login attempts used the manufacturer’s publicly documented factory-default username and password, and the attackers used hosting tolerant of malicious traffic¹.

Xavier Bellekens, Lupovis’s chief executive, said the overlap with infrastructure “previously associated with Russian-linked malicious operations” caught the firm’s attention. He also said it was “not able to pinpoint a group yet”¹. No group has claimed responsibility².

Fixing this is not only a patching job. Stephan Moelans, chief executive of Sabcobel, which runs Delhaize’s refrigeration systems, said the units needed physical modifications, not just software updates⁶. He said: “The simplest solution is to manage the fridges over a secure internet connection. Most of our customers switched to that after the attack in France”⁶. Danfoss said it identified some security flaws last year and had “long recommended” customers install updates². Patrick Lamplmair of the security firm Tributech said thousands of controllers were still reachable from the internet after the French attack². Copeland said it is talking to affected customers and has recommended software fixes¹.

What to write into cold-store contracts

For buyers who do not run refrigeration, the exposure sits with the operator. Portuguese retailer group Mosqueteiros said its attack appeared to target an external service provider that managed the refrigeration systems⁴. That puts the maintenance chain inside your supplier risk.

Four checks are worth making this quarter. First, get written confirmation that factory-default credentials have been changed and are rotated, because default logins ran through the probing¹. Second, require remote access over a secure connection rather than direct internet exposure⁶. Third, ask for logging and out-of-hours alerts on setpoint changes, since these attacks were carried out remotely and no malware was needed⁵. Fourth, agree a notification window and rules on who may touch the equipment, because physical modification, not software alone, was required in Belgium⁶.

Patching alone is slow in this industry. Nick Jackson of Bitdefender said updates can take time to run and leave machinery offline, and that the people running the fridges may not have it on their agenda⁵.

The losses, and who pays

Company counts reported so far: 40 Delhaize stores in Belgium and Luxembourg⁷, about 15 Carrefour Belgium shops out of 700², and five Colruyt or Spar outlets⁶. Also counted were one Ikea store in Mons⁶, 13 SuperValu shops out of 223 in Ireland², seven out of 800 Coop stores in Sweden⁶, at least 17 Dutch companies according to Danfoss², and seven Intermarché stores in Portugal⁴. Some counts differ: Coop told the Aftonbladet daily that six shops were hit².

Confirmed losses are still small next to the disruption. A Delhaize branch in Hoeilaart, near Brussels, put its loss at €100,000⁶. In France, individual supermarkets reportedly lost from tens of thousands of euros to more than €130,000². In Portugal, the retail association APED said three of the seven affected stores had product losses, which will be destroyed⁴.

Nobody has published a total. On insurance, the trade title Insurance Business reported that property claims were being notified over the French attack and that the cause of loss will decide which policy pays. It said the second wave raised fresh questions over cyber exclusions and aggregation across Europe³. No ransom demand has been reported, and no group has claimed the attacks^5, 2. The Paris prosecutor’s office has opened a formal investigation².

What to watch

Attribution is the biggest open question. Chichester said the NCSC was not able to comment on who might have carried out the attacks. He said they were not AI-enabled and used vulnerabilities that had been “out there for a long period of time”¹. Rafe Pilling of Sophos put the two most plausible scenarios as state-based signalling or a lone-wolf hacker⁵.

Watch whether the US incidents connect. Refrigeration malfunctions hit commissaries at US military bases in August, the Pentagon is investigating a suspected hack, and US authorities are working with French officials on possible links^5, 6. Watch regulators too: Belgian and Swedish agencies said they were monitoring⁶, and France’s Ansii reported that controllers from two other companies had also been targeted².

For buyers, the practical risk is concentration. Lamplmair said attackers would keep going “until it stops working” because the method was cheap and the damage immediate².

What this means for procurement teams

Cold storage is now a cyber dependency, not just a property line. The systems that hold chilled and frozen stock are reached remotely, and the entry point in this campaign was as basic as unchanged factory passwords¹. A buyer who contracts space from a cold store or 3PL is relying on that operator’s login hygiene for goods that can be worthless within hours.

Ask three questions before your next storage and handling renewal. Who maintains the controllers, and are they a subcontractor you have never assessed⁴? Is remote access over a secure connection, or open to the internet⁶? What is the notification window if setpoints move, and who bears the loss while stock is quarantined³?

On cost, do not assume insurance closes the gap. Property claims are being notified over the French losses, the cause of loss decides which policy responds, and cyber exclusions and aggregation across sites are open questions³. Check where spoilage risk sits under your terms, including DDP or DPU arrangements where your supplier holds the goods longer.

Then act: demand written credential rotation and a patch schedule with agreed downtime, qualify a second cold store for peak volumes, and time the contract review to your renewal date rather than after a loss. Attribution is not settled, so plan for repeat attempts rather than a single event^1, 5.

Sources

1.The Guardian, Food suppliers in UK hit by cyber-attacks after freezers targeted in Europe, 3 November 2026. Accessed 4 November 2026.
2.The Guardian, Shop fridges and freezers across Europe hit by fresh suspected cyber-attack, 2 November 2026. Accessed 4 November 2026.
3.Insurance Business, Cyber Insurance News for the UK from Insurance Business. Accessed 4 November 2026.
4.theportugalnews.com, Cyberattack affects seven Intermarché stores in Portugal, 3 November 2026. Accessed 4 November 2026.
5.The Guardian, Who is hacking Europe’s supermarket fridges and freezers, and why?, 3 November 2026. Accessed 4 November 2026.
6.BBC News, Shop freezers in seven European countries hit by cyber-attack, 2 November 2026. Accessed 4 November 2026.
7.BBC News, 'All this food is now useless': Piles of rubbish after shop freezers hit by cyber-attack, 2 November 2026. Accessed 4 November 2026.

How this story was made: the Procupy News Desk researched and wrote it with AI tools, working only from the sources listed above. Automated checks confirmed that every number and quote appears in those sources, and a separate AI fact-check compared the story with them before publication. Read our editorial policy. Spotted a mistake? Tell us and we will fix it.