British businesses caught in Europe-wide supermarket fridge attacks
Supermarket and grocery store refrigerator controls across Europe were hacked in the early hours of Monday in the second such wave of attacks in recent weeks — following a first wave in France — with unidentified perpetrators defrosting fridges and causing stock to spoil.
Three meat suppliers in Britain are among businesses that have been caught in a wave of cyberattacks across Europe targeting refrigeration systems, according to an industry trade body.
Supermarket and grocery store refrigerator controls across Europe were hacked in the early hours of Monday in the second such wave of attacks in recent weeks — following a first wave in France — with unidentified perpetrators defrosting fridges and causing stock to spoil.
The Association of Independent Meat Suppliers (AIMS) told Recorded Future News that its three affected members were attacked through vulnerable Copeland XWEB supervisory controllers.
A Copeland spokesperson confirmed that certain XWEB monitoring solutions are impacted by the reported vulnerability. “We are continuing to assess the circumstances and have taken the appropriate actions based on the specific products involved,” they said in a statement. “As part of our response, we have re-communicated the recommended patching and security protocols to ensure customers have the latest guidance to protect against the identified threats.”
AIMS spokesperson Tony Goodger described the association’s members as “collateral” because they ran the same software. None of the affected members lost meat, he said, but the incident “must act as a reminder to all in the food industry, at whatever point in the supply chain they are, that their businesses may be seen by some as targets.”
No hackers have claimed responsibility for the attacks. British authorities say they have not attributed the incidents to any group, while a spokesperson for Belgium’s cybersecurity agency told Recorded Future News “it may never be possible to identify” who was behind them.
Langridge Organic, a British fruit and vegetable wholesaler, told trade publication The Grocer that it had also been attacked. The company’s managing director Alex Pearce said it “was amazing how many parameters” the attackers had changed after accessing the controllers.
Pearce said he was “pretty sure that I interrupted a live hacking event,” as he physically disconnected a fridge from the internet after observing it being remotely put into defrost mode. He said no stock was spoiled as a result of his team’s physical interventions.
All of the British suppliers were reportedly using vulnerable temperature controllers for which a firmware update had been available since August. According to a security note shared among AIMS members, firmware for Copeland XWEB — version 1.12.1 and earlier — contained “severe authentication bypass vulnerabilities that allow hackers to take control without a password.”
National impact ‘minimal’ says NCSC
Britain’s National Cyber Security Centre (NCSC) said Tuesday it was aware of the refrigeration attacks and assisting affected organizations. Its staff had worked through the night in an attempt to proactively contact companies that it detected had vulnerable systems exposed to the internet.
Speaking at the launch of the agency’s annual report, Paul Chichester, its director of operations, said the impact was “minimal” so far.
Richard Horne, NCSC’s chief executive, added that “although at a national level the impact is minimal, if you’re running the business that’s been hit by that, it is an enormous issue for you and your employees and everyone else.”
The NCSC’s annual report raised the alarm about “the failure to implement even basic cyber protections” with Horne warning that Britain faced the “real prospect of an unprecedented rise in the number of cyber incidents” in the coming months.
The businesses impacted in the fridge attacks appear to fit that pattern, given that they were running firmware that was known to be flawed. In August, researchers at industrial cybersecurity company Claroty disclosed almost two dozen vulnerabilities in Copeland’s XWEB Pro controllers.
In reference to the first wave of attacks in France, the NCSC said the attacks were not sophisticated. “This is using vulnerabilities that absolutely have been out there for a long period of time,” said Chichester.
Horne said the attacks on freezers were “really just sort of the foothills” of the threat the agency was warning of in its report. “There are so many vulnerabilities out there that, in some ways, you could say are waiting to be exploited,” he said.
Ollie Whitehouse, the agency’s chief technology officer, said he and his colleagues were “surprised to see some of these things being connected to the internet still in 2026, despite warnings that we have put out over the last couple of years.”
AIMS is urging the government to give the food sector a stronger place in Britain’s designation of critical national infrastructure. No individual food sector assets are currently designated as critical under existing legislation.
The sector is also not included under the forthcoming Cyber Security and Resilience Bill, which would require the operators of essential services to maintain appropriate security measures — such as patching vulnerable systems promptly — or face a fine of up to £17 million ($22 million) or 4% of their global turnover for serious failures.
The European Union’s counterpart legislation, NIS2, also covers food production and distribution. However, as reported by Politico, its breadth has drawn criticisms for potentially also catching “ice cream makers, Christmas lights manufacturers and German landlords.”
Alexander Martin
is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79
