UK and Europe hit by wave of fridge hacks as thousands more systems remain exposed
Unknown attackers turn up the heat across the Continent, leaving a trail of ruined food in their wake.
Security researchers warned that thousands of refrigeration systems were dangerously exposed to hackers just days before a fresh wave of attacks disrupted supermarkets across Europe, forcing retailers to throw away spoiled food.
On Monday, November 2, unknown actors hijacked fridges and freezers across Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. At one supermarket, freezers reportedly reached 50 degrees Celsius.
Swedish furniture giant IKEA was also caught up in the attacks, confirming that refrigeration systems at its store in Mons, Belgium, had been compromised, forcing staff to remove some food products from sale as a precaution.
This incident prompted Britain's National Cyber Security Centre (NCSC) to reveal that similar attacks are also impacting Britain's food supply chain.
At the time of writing, we cannot confirm why these critical systems have been targeted - although it's easy to see why a hostile state would seek to wreak havoc with food supplies as an act of cyberwar. We are not aware of any ransoms being publicly announced but will update the story if that changes.
Last week, Forescout Research's Vedere Labs identified 12,976 internet-exposed refrigeration service observations across 99 countries and territories, including significant exposure in Italy and Greece.
It advised: "Internet-exposed refrigeration systems are popular in several European countries beyond France, which could become the next targets of similar attacks."
The warning came after landmark research from Claroty spotlighted the chilling risk (sorry) vulnerabilities in refrigeration systems pose to food supply chains, followed by an attack on French supermarkets in which hackers raised cooling system temperatures so high that fires broke out.
Pro-Russian hackers to blame?
The immediate and obvious target for any attribution is Russia, which is quietly engaged in hybrid warfare against Western targets.
Forescout's research revealed that attacks against refrigeration equipment have been occurring throughout 2026, well before the incidents that disrupted hundreds of French supermarkets in October.
Since January, its researchers have tracked more than 20 attacks claimed by hacktivist groups against refrigeration systems.
Two pro-Russian groups, Z-Pentest Alliance and NoName057(16), were among the most active.
Their reported targets included supermarkets, wineries, fruit storage facilities and agricultural and food processing businesses across Spain, Italy and other European countries.
On April 26 alone, Z-Pentest claimed responsibility for 10 separate attacks.
However, Forescout did not establish that either group was responsible for the recent attacks in France or elsewhere in Europe.
The research showed how hackers can cause serious physical and financial damage without deploying sophisticated malware. It also reveals the utter folly of connecting critical infrastructure - which refrigerators surely must be, considering they feed so many billions of people - to the internet.
Modern refrigeration systems often allow technicians to remotely adjust temperature settings, initiate defrost cycles and manage other functions.
They also let attackers gain unauthorized access and abuse these legitimate controls to warm refrigerated goods, potentially destroying valuable stock.
UK cyber chief warns of neglected technology
Dr. Richard Horne, chief executive of the UK's NCSC, warned that businesses had failed to invest sufficiently in the technology underpinning essential services.
Speaking to BBC Radio 4's Today program on Tuesday morning, Horne said the agency had observed "a couple of instances where vulnerable technology had been exploited in the UK".
He said the technology society relies on had not received adequate investment, leaving aging and poorly secured systems exposed to attack.
Horne also warned that artificial intelligence could make existing vulnerabilities easier for attackers to discover and exploit, although there is no confirmed evidence that AI was used in the refrigeration attacks.
The British Association of Independent Meat Suppliers said some of its members had been affected by the incidents, although none had lost meat.
Amir Preminger, CTO of Claroty, said the attacks highlight the "growing trend" of threat actors seeking "widespread, high-impact disruptions to essential services".
"Heightened geopolitical tensions have driven a surge in activity targeting critical infrastructure, while AI technologies enable attackers to rapidly scan networks for vulnerabilities and weaknesses in access controls," Preminger said.
"The series of fridge hacks across Europe highlights the fragility of cold chains across a wide range of industries beyond supermarkets and grocery stores.
"Refrigeration controllers are also used in hospitals, pharmaceuticals, water utilities, data centers, and more. Essentially, any organisation that handles temperature-sensitive goods is at risk and must take action to protect themselves from a similar attack."
The problem is made worse by an "AI-powered tsunami of critical software vulnerabilities such as PHP," he continued.
READ MORE: "Mutually assured deception": Hackers hijack Ukrainian and Russian emergency alert apps
According to the Electronic Frontier Foundation, 3% of all recorded software vulnerabilities were discovered in October alone, while nearly a quarter have been identified in 2026.
Preminger said: "With modern AI capabilities, attackers no longer need special skills to analyse the device firmware and find vulnerabilities against a list of internet-exposed devices.
"Our research shows that attackers could potentially use advanced AI capabilities to reproduce the refrigeration controller vulnerabilities we discovered, and achieve root-level command execution on a lab device in about 28 minutes for $6 USD in AI usage."
It now seems very likely that we will see even more attacks on refrigeration systems that literally feed the world.
Joshua Marpet, Senior Product Security Consultant, Finite State, said: "In the wake of at least two waves of successful attacks against the infrastructure supporting food distribution, we have to assume that there will be others.ㅤ
“If you’re in a critical infrastructure industry, this is the moment that determines whether you’re on the front page of the Wall Street Journal for all the wrong reasons."ㅤ
“Putting our heads in the sand is no longer a viable strategy."
Why food supply chains are a tasty target
Food supply chains are particularly vulnerable to disruption because perishable goods can be destroyed within hours, meaning that even brief interruptions can cause substantial financial losses, and the consequences are immediately visible to the public.
Martin Riley, CTO at Bridewell and a critical infrastructure security specialist, said: "Food and drink combines three things an attacker looks for. The product is perishable. The margins are thin. And the whole operation runs against the clock.
"In most of IT security we protect confidentiality first. We worry about data being stolen. In operational technology that priority flips. Availability and integrity come first, because the process has to keep running and keep running correctly. A supermarket fridge holds no secrets. It holds a temperature.
"Change that temperature overnight and you destroy the value of everything inside it within hours. There is no backup to restore from. The stock is simply gone."
The risk is exacerbated in a sector that is "highly distributed and heavily outsourced," Riley continued.
The food supply chain relies heavily on outsourced contractors who remotely manage refrigeration and production equipment across hundreds of sites, creating a vast attack surface that often escapes corporate security teams.
"The targets are easy to find and the attack is easy to repeat," he warned. "Our own analysis found more than 6,000 refrigeration management panels from a single manufacturer visible on the open internet worldwide.
"In the UK, more than 800 refrigeration and building-control interfaces have been reported as reachable online. Many of these systems were never designed to face the internet directly. Some are running end-of-life models that the manufacturer stopped updating years ago, so no fix will ever arrive for them."
READ MORE: Critical UK subsea power cables suffer "multiple exposures", National Grid reveals
The search for convenience which led companies to connect vital systems to the internet is likely to create many more problems going forward.
Alan Simpson, Field CISO at Rapid7, said: "Recent incidents highlight the opportunity for attackers when connected refrigeration systems are poorly protected, and the consequences for stock, trading, and food safety.
"Remote maintenance makes refrigeration easier to manage, but retailers need a clear picture of every connected system, who can access it, and who is responsible for its security. That responsibility needs to be explicit between the retailer and its maintenance suppliers."
Waseem Ahmed, Head of Engineering at Secure.com, said the common thread in recent incidents is likely to be remotely reachable controllers, not a fridge fault.
He stated: "French authorities named specific refrigeration controllers, researchers found thousands reachable from the internet, and one expert said many ran default passwords. Some older models no longer get security updates. The latest wave is still being confirmed, so I wouldn't point at one vendor or one flaw today.
“Three checks to run before the week ends. #1 - List every controller your stores run, with model and firmware. #2 - Pull the management screens off the public internet and put remote access behind a VPN. #3 - Change every shared password, including the ones your refrigeration contractor uses.
“Then add temperature alarms that don't depend on the controller being alarmed, because attackers in France reportedly lengthened defrost cycles and delayed the warnings."
