Hackers Turned UK Food Fridges Against Their Owners

Cyberattacks targeting refrigeration systems have reached UK food businesses, with attackers accessing controls used to keep chilled storage rooms operating at the right temperature. The National Cyber Security Centre (NCSC) says it is working with a small number of potentially affected UK organisations, although the national impact has so far been described as minimal.

One of the clearest examples involves Langridge Organic, a West London fresh-food wholesaler. The company told The Grocer that hackers accessed six of its ten cold-room control systems, remotely triggered defrost cycles and changed settings that normally help protect stored food.

The incident could have resulted in stock losses. But regular manual temperature checks helped the business spot the problem, and it reported that no stock was lost.

The attacks highlight a part of business technology that rarely attracts public attention: the connected equipment that controls refrigeration, heating and other physical processes. When those systems are poorly secured, a cyberattack can move beyond computers and affect the machinery businesses depend on every day.

What happened to UK food businesses?

The UK impact became clearer on 3 November 2026, when the NCSC confirmed that it was aware of a small number of UK organisations that may have been affected by the refrigeration incidents.

Paul Chichester, the NCSC’s director of operations, said the agency was working with affected organisations and described the national impact as “minimal”.

The NCSC also said it was contacting organisations whose technology appeared vulnerable. Its chief executive, Dr Richard Horne, confirmed that teams had been working overnight to alert UK businesses with exposed technology.

The exact number of affected UK companies and the full extent of the disruption have not been publicly established. Reports include meat-processing businesses as well as the fresh-food wholesaler identified by The Grocer.

Langridge Organic provides a particularly clear account of what the attackers were able to do.

The West London wholesaler told The Grocer that six of its ten cold-room control systems had been accessed. The attackers remotely placed the cold rooms into defrost cycles, raised temperature settings and changed several other parameters.

They also disabled automated messages that would normally alert the business when temperatures moved outside the required range.

Langridge Organic managing director Alex Pearce described the number of changes as surprising. Speaking to The Grocer, he compared the activity to “kids put in front of a mixing desk” moving controls in the wrong direction.

Pearce also said he believed he had interrupted an ongoing attack after noticing unusual behaviour. He disconnected the affected equipment from the internet.

The company reported no stock losses because staff carried out regular manual temperature checks. That detail is important: the connected systems had been interfered with, but independent checks helped staff identify that something was wrong.

It is a practical reminder that businesses should not rely entirely on a single connected controller to confirm that essential equipment is operating normally.

The attacks began with refrigeration systems in Europe

The UK incidents followed a wider series of reported attacks and disruptions involving supermarket refrigeration equipment across Europe.

On 2 November, retailers in several countries reported problems with cooling systems. Reports described incidents or suspected cyber activity affecting businesses in Belgium, Sweden, Ireland, Luxembourg, Estonia, the Netherlands and other European markets.

In Belgium, supermarket groups reported disruption across multiple locations. In Sweden, retailer ICA also reported refrigeration problems affecting stores. Other retailers and food businesses reported temperature irregularities or cooling systems that were not operating as expected.

The incidents followed an earlier wave in France during October. Reports said attackers had remotely manipulated refrigeration systems at hundreds of supermarket locations, raising temperatures in fridges and freezers. Food was reportedly spoiled, and some reports also described fires at affected locations.

The incidents share similarities, particularly the manipulation of connected refrigeration equipment. However, investigators have not publicly established that every incident was carried out by the same attackers or formed part of one coordinated operation.

No responsible group has been publicly identified.

How can hackers control a commercial fridge?

Commercial refrigeration systems are more complex than ordinary household fridges. Food businesses often use connected controllers to monitor temperatures, manage cooling and defrost cycles, and allow engineers to adjust equipment remotely.

Remote access can be useful. A maintenance technician may be able to check a unit or change its settings without travelling to the premises.

The risk appears when those controls are exposed to the public internet or protected by inadequate security.

In its reporting on the UK incidents, The Grocer identified Dixell XWEB software in the affected cases. It reported that web login pages for some refrigeration controllers could be found on the open internet and that security updates addressing known vulnerabilities had not been installed.

The NCSC has separately highlighted the danger of older technology connected to the internet with default passwords in connection with the earlier French attack.

These details point to weaknesses in connected equipment and its protection. They do not establish that every refrigerator, freezer or refrigeration product is vulnerable.

A compromised controller may allow an intruder to change temperature settings, trigger a defrost cycle or interfere with monitoring and alerts. If staff do not notice the changes quickly, stored food may be exposed to temperatures outside the conditions required for safe storage.

The precise access method may differ between systems. It would therefore be inaccurate to claim that every affected business was compromised in exactly the same way.

Why is the NCSC warning about older technology?

The NCSC’s involvement reflects a wider concern about the security of technology that controls physical processes.

At the launch of its Annual Review on 3 November, NCSC chief executive Dr Richard Horne warned that organisations had spent years postponing upgrades and failing to maintain technology properly.

He described the approach as “tech on the cheap”, referring to end-of-life systems being kept in service, necessary upgrades being delayed and security not being maintained throughout the life of equipment.

Horne’s warning was not limited to supermarket refrigeration. He specifically referred to technology used in electricity systems, water facilities, manufacturing, heating and refrigeration controls.

In his published speech, he said the security of systems that automate physical processes had been overlooked in investment decisions. He also linked that wider weakness to the refrigeration disruption being seen across Europe.

This matters because operational technology is different from ordinary office IT. It controls or monitors equipment in the physical world. A problem with an office computer may interrupt work or expose information; interference with an operational controller can also affect machinery, temperatures or production processes.

The NCSC also warned that artificial intelligence could help hostile actors discover and exploit existing weaknesses more quickly and at greater scale. That is a broader warning about the changing cyber threat.

There is no verified evidence that AI was used in these refrigeration attacks. The NCSC’s comments about AI should not be treated as proof that the incidents were AI-driven.

Are UK food supplies being disrupted?

The incidents are serious for the businesses involved, but the available evidence does not establish a nationwide disruption to Britain’s food supply.

The NCSC has described the current national impact as minimal and said it is working with a small number of potentially affected organisations. The reported UK cases include food-processing businesses and the Langridge Organic wholesaler.

A refrigeration incident can cause a business to lose stock, interrupt operations or temporarily change how it stores products. But disruption to an individual cold room does not automatically mean that an entire supermarket chain or national supply network has stopped working.

There is no verified evidence from these incidents that the UK is facing nationwide food shortages.

For shoppers, the sensible response is to follow reliable updates rather than panic-buy food or assume that products in shops are unsafe. The reporting so far concerns the security of refrigeration systems at affected businesses, not evidence that food across UK stores is unsafe.

What should food businesses do to protect refrigeration systems?

The incidents offer a practical warning to supermarkets, food processors, wholesalers, independent butchers and other businesses that depend on connected cooling equipment.

The following measures are consistent with established industrial cyber security practices:

1. Keep refrigeration controllers off the public internet

Remote access should not mean that a control panel is openly reachable from anywhere online. Businesses should review how refrigeration systems connect to the internet and use properly secured remote-access arrangements.

2. Change default passwords

Default or easily guessed passwords can leave equipment exposed. Each system should use strong, unique credentials, with access limited to people who need it.

3. Install available security updates

Businesses should check with their refrigeration equipment supplier or maintenance provider for security updates. Updates should be tested and installed according to the supplier’s guidance.

4. Separate operational equipment from ordinary business networks

Where technically appropriate, refrigeration controls should be segmented from everyday office computers, guest Wi-Fi and other networks. This can make it harder for an attacker who compromises one system to reach another.

5. Monitor temperatures independently

Do not rely entirely on the same connected controller to report that everything is working normally. Independent temperature checks and alerting arrangements can help staff identify unexpected changes.

6. Review third-party access

Refrigeration systems are often installed, maintained or remotely managed by outside suppliers. Businesses should know who can access the equipment, how that access is protected and whether old accounts have been disabled.

7. Prepare a manual response

Staff should know what to do if a cooling system behaves unexpectedly or loses its connection. A clear procedure for checking temperatures, contacting engineers and protecting stock can reduce the consequences of an incident.

These measures cannot guarantee protection against every attack. Businesses should consult equipment manufacturers, maintenance providers and qualified industrial security specialists before changing operational settings.

What does the new Cyber Essentials support mean for UK businesses?

Alongside its warnings about weak technology, the UK Government announced a new funding package for Cyber Essentials on 3 November.

The Cyber Essentials First Step Fund offers eligible micro, small and medium-sized businesses a 75% discount on the cost of their first Cyber Essentials certificate. The government says the offer is expected to run until the end of March 2027, or until the available funding runs out.

A separate Cyber Resilience Pledge grant can provide selected suppliers in participating organisations’ supply chains with fully funded certification and access to a Cyber Advisor.

Cyber Essentials is designed to help organisations address common cyber security risks. It is a useful starting point, but it should not be treated as a complete security solution for industrial refrigeration or other operational technology.

Businesses still need to assess the specific equipment and systems that control their physical operations.

Eligible businesses can read the details in the Government’s Cyber Essentials funding package.

What is still unknown?

Several important questions remain unanswered.

The full number of affected UK businesses has not been confirmed publicly. The NCSC has described a small number of potentially affected organisations, but its assessment and work with affected businesses are continuing.

It is also unclear whether all the incidents across Europe and the UK were carried out by one group, whether the attackers had the same motive or whether every affected system was accessed through the same weakness.

No responsible group has been publicly identified. There is also no verified evidence that artificial intelligence was used to carry out the refrigeration attacks.

These uncertainties matter. The incidents should not be presented as a confirmed nationwide attack on Britain’s food supply or as proof that every refrigeration system is at risk.

What is established is that attackers interfered with refrigeration controls, UK businesses reported impacts, and the NCSC is working with potentially affected organisations.

The wider lesson is that equipment responsible for essential physical operations needs the same serious attention to security as the computers and networks businesses use every day.