A coordinated supermarket refrigeration cyberattack that spoiled thousands of tonnes of food across continental Europe has spread to the UK, the National Cyber Security Centre confirmed on Tuesday. British security officials said attackers exploited internet-connected cooling infrastructure overnight, following widespread food losses across grocery chains in Belgium, Ireland, Sweden, Estonia and Luxembourg.
Key points
- The National Cyber Security Centre confirmed that hackers breached cooling equipment at a small number of British organisations overnight.
- Grocers in at least seven European countries have reported refrigeration systems forced into defrost mode or turned as high as 50C.
- The incident follows similar intrusions in France during October that affected hundreds of retail cooling units.
- Security officials said the breach targeted known vulnerabilities in remote management systems used by commercial refrigeration suppliers.
Intrusions reach British food suppliers
Dr Richard Horne, chief executive of the National Cyber Security Centre (NCSC), told BBC Radio 4’s Today programme that the agency worked through the night to notify British companies at risk. Horne said officials were aware of “a couple of instances where vulnerable technology had been exploited in the UK” and had alerted dozens of potentially vulnerable organisations.
Horne said investigators could not yet attribute the campaign to a specific nation or cybercrime syndicate. The intrusions targeted internet-facing control units that allow technicians to monitor chilled distribution rooms, open display freezers and fresh meat cabinets without visiting the site.
The British incidents come after earlier refrigeration attacks across six European nations caused stock losses running into millions of euros. British retail trade groups said they were reviewing third-party maintenance access to avoid further store disruptions.
How attackers manipulated cooling hardware
The campaign attacks commercial operational technology, specifically the digital controllers that regulate compressor cycles, defrost intervals and temperature reporting. In Belgium, Stephan Moelans, chief executive of cooling engineering company Sabcobel, said attackers forced system evaporators into defrost mode, heating units that should maintain negative temperatures.
In Stockholm, staff at an ICA Baronen branch arrived to find freezers reading 50C. Store managers said the compromise started at 2.00am local time but remained undetected until early morning checks at 5.30am, ruining frozen lines and forcing closures. Other branches operated by Swedish grocer Coop reported identical temperature hikes across six locations.
Similar interventions occurred in Estonia, where commercial cooling firm Kitman Coldtech reported that an unnamed supermarket chain had its chiller thermostats remotely overridden to 50C. In Ireland, Musgrave Group confirmed that refrigeration units across 13 franchised SuperValu branches suffered overnight temperature spikes, requiring staff to clear spoiled meat, poultry and dairy products from shelves.
These coordinated failures expand on breaches across Belgium and Sweden that began over the weekend, when retailers Ahold Delhaize, Carrefour and Colruyt detected tampering across dozens of sites. Colruyt Group said five of its Spar franchise locations in Belgium lost cooling control.
Stock destruction across the supply chain
The financial impact of the temperature adjustments has fallen heavily on individual franchisees and independent suppliers. Independent butcher Luc De Laet, founder of Belgian meat processor De Laet & Van Haver, said an employee alerted him at 3.30am after readings in his Hove butchery climbed to 18C.
De Laet said the incident destroyed roughly €15,000 worth of premium meat products. Another Delhaize store in Belgium calculated its stock losses at €100,000 after fresh departments had to be emptied into disposal skips.
French authorities dealt with an earlier wave of identical breaches in October, when intruders hijacked cooling systems at hundreds of supermarkets. In several French stores, heating elements inside large cold storage rooms remained engaged for hours, generating enough heat to spark structural fires alongside total stock spoilage.
Why retail refrigeration systems were vulnerable
Industrial refrigeration plants rely on digital controllers connected to local area networks or cellular modems. These controllers allow engineering contractors to monitor gas pressure, clear ice build-up and gather compliance data mandated by food safety authorities.
Security researchers highlighted severe software flaws in several widely deployed retail cooling controllers earlier this year. Many systems run on unsegmented store networks, use default passwords, or lack multi-factor authentication for administrative web portals exposed directly to the public internet.
Horne warned that critical sectors continue to rely on hardware that companies have failed to update or isolate. He noted that businesses routinely run equipment past its supported lifespan without disconnecting management ports from public networks.
He added that malicious actors increasingly pair automated vulnerability scanners with artificial intelligence tools to find and exploit neglected internet-facing controllers at scale, turning commercial operational systems into accessible targets.
Securing commercial operational networks
European cybersecurity authorities, including the French cyber agency ANSSI and the Belgian Centre for Cybersecurity, have instructed supermarket operators to sever external internet connections on cooling plant controllers immediately. Technicians have been instructed to manage setpoints manually from wall-mounted panels until suppliers issue patched firmware.
Supermarket groups are also auditing the remote management credentials held by refrigeration contractors. Because regional engineering firms often manage temperature telemetry for hundreds of franchise stores through a single administrative portal, a compromise at one maintenance supplier gives attackers immediate reach into dozens of retail chains.
The NCSC said it will publish technical indicators and mitigation guidance for food logistics operators and building facilities managers as forensic teams examine the compromised British controllers.
