The supermarket fridge cyberattack spreading across Europe has reached the UK, with the National Cyber Security Centre confirming “a couple of instances” in which vulnerable technology was exploited.

Dr Richard Horne, chief executive of the National Cyber Security Centre, told BBC Radio 4’s Today programme that staff had “worked through the night” to warn potentially affected organisations. The agency contacted “handfuls” of bodies and knew of “a couple of impacts”, though it has not identified the businesses involved.

No attacker has been publicly named. Horne said it was still “too early to say” who was responsible.

How widespread were the refrigeration attacks?

More than 100 European stores were affected in the November 2 wave, according to SecurityWeek. Reuters, the Associated Press and SecurityWeek reported incidents across Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden, while some accounts also included Finland, Denmark and Portugal.

The confirmed disruption included:

  • 15 Carrefour stores in Belgium
  • 13 SuperValu stores operated by Musgrave in Ireland
  • At least 17 Dutch businesses, mainly butcher shops and smaller grocery stores

Hackers remotely changed temperature settings on refrigeration equipment. In Estonia, refrigeration executive Jann Mutso said one freezer was set to 50C, but its actual temperature rose by only 2C to 3C before technicians restored the correct settings. No products were lost in that case.

The latest incidents followed a much larger attack in France on October 12. Le Monde reported that more than 700 supermarkets were affected, spoiling fresh and frozen food worth millions of euros.

European Union agriculture commissioner Christophe Hansen called the incidents “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it.” That assessment describes the apparent purpose of the attacks, not their authorship, which remains unknown.

Why were the systems so easy to reach?

Evidence gathered since the attacks suggests many refrigeration controllers were directly accessible from the internet. Security researcher Kevin Beaumont said every affected freezer he had verified had an internet-facing management interface.

Cybersecurity company Lupovis detected suspicious probing of decoy Danfoss refrigeration controllers between October 20 and 30, several days before the November attacks. Most attempts reportedly relied on publicly documented factory-default credentials. Advanced tradecraft, this was not.

France’s National Agency for the Security of Information Systems linked earlier compromises to Danfoss AK-SM and AK-SC controllers, along with Copeland XWEB and Dixell XWEB products. The United States Cybersecurity and Infrastructure Security Agency disclosed two Danfoss AK-SM 8xxA vulnerabilities in 2025:

  • CVE-2025-41450, an authentication bypass flaw
  • CVE-2025-41451, a command injection flaw

SecurityWeek reported that many exposed devices have reached the end of their supported life and cannot be patched. Danfoss said it advised customers on October 13 to disconnect controllers from the open internet and reconnect them only through secure networks. According to the company, “most stores took action”, but “a small number did not”.

Retailers can also be reluctant to install updates because doing so may require machinery downtime, Bitdefender researcher Nick Jackson said. That leaves operators balancing planned disruption against the much less convenient variety arranged by an unknown attacker.

The UK warning goes beyond supermarket freezers

Horne said the incidents exposed a broader failure to maintain the technology used in essential daily services. Many organisations continue operating systems beyond their intended lifespan, without upgrades or adequate separation from the public internet.

“That technology base we rely on as a society has not been invested on to the extent it needs to be,” he said.

He also warned that artificial intelligence could help hostile actors discover and exploit weaknesses more quickly. The immediate recommendation was less futuristic: organisations should identify the systems they depend on, replace obsolete equipment and keep operational technology away from direct internet access.

European Union rules require companies to report exploited end-of-life products, according to Recorded Future News, but they do not force manufacturers to repair unsupported equipment. That leaves responsibility divided among manufacturers, retailers and operators, while an old controller with a default password remains online and available to anyone who bothers to look.

“We intervene where we can,” Horne said. “But, at the end of the day, it’s your business. It’s your charity. It’s your life. You need to make the choice and choose wisely.”