The Fridge Attacks Have Reached UK Meat Plants. Seven Questions for Your Refrigeration Contractor This Week

On the night of 11 to 12 October 2026 somebody reached the refrigeration controllers at hundreds of French supermarkets over the internet, pushed the chillers and freezers to around 50°C, and stretched the defrost cycle so that the alarms stayed quiet. On Monday 2 November it happened again in six more countries. On Tuesday 3 November the National Cyber Security Centre said it was aware of a small number of UK organisations that may be affected, and the reporting named meat processing firms.

This post is what a UK food site can check this week, taken from the French national alert and from the NCSC’s own words. It also says, early and plainly, what a visitor and contractor sign-in kiosk does about any of this.

What happened, with dates

• 12 October, France. About 700 of the country’s roughly 10,000 supermarkets, on the finance minister’s count to parliament (SecurityWeek, 15 October). Intermarché said units at about 150 of its stores ran at 50°C for six hours and all the food was discarded. The Paris prosecutor’s cybercrime unit said the attack caused fires as well as food losses. Le Monde reported that the defrost cycles had been lengthened from one hour to as many as eight, which delayed the alarms.
• 12 and 13 October, the French alert. CERT-FR, the national computer emergency response team, published alert CERTFR-2026-ALE-012: numerous compromises of the remote controllers of refrigeration installations, Danfoss AK-SM and AK-SC series, with Copeland XWEB and Dixell XWEB added the next day.
• 2 November, six countries. Sweden, the Netherlands, Belgium, Ireland, Luxembourg and Estonia (NBC News with Reuters, 2 November). Musgrave said refrigeration at 13 of its SuperValu stores in Ireland was hit. Coop in Sweden said six stores. The Belgian refrigeration company that runs Delhaize’s systems said the evaporators had been switched to defrost mode. In Estonia the attackers reached the computer controlling a client’s refrigeration and set it to 50°C. ICA in Sweden said its own systems were not touched and that the incident was at “a small number of stores that use an external supplier and have their connectivity outside ICA’s central network”.
• 3 November, the UK. An NCSC spokesperson said the centre was “aware of a small number of UK organisations that may be affected by this incident”. Paul Chichester, its director of operations, said the impact was minimal and that the NCSC was working with the businesses involved. Dr Richard Horne, its chief executive, said at the launch of the NCSC Annual Review 2026 that teams had worked through the night to alert British firms that are vulnerable, and that the French attack “involved legacy technology connected to the internet with default passwords” (Sky News report, carried by V2 Radio, 3 November). ITV’s headline the same day: “UK meat processing firms hit amid fridge and freezer cyber attacks”.

Nobody has claimed responsibility. Dr Horne said it was “simply too early to tell” who was behind it.

How it was done

Nothing clever, on everything published so far. A refrigeration controller with its admin web page reachable from the public internet, a default password or firmware the maker stopped supporting, and a change to a setting the controller was built to accept. Danfoss said most of the affected devices were older AK-SM 800 and AK-SC 355 units that are out of support; SecurityWeek reports that support for the AK-SM 800 ended in May 2021. Censys counted nearly 3,000 internet-exposed Danfoss StoreView panels on 11 October, more than 1,800 of them in France. The head of Sweden’s national cyber security centre said his team had “identified that we have quite a lot of exposed operational technology devices in Sweden”.

The detail for a UK food site to notice is ICA’s. The stores that were hit were the ones whose refrigeration was looked after by an outside supplier, on the supplier’s own connection, outside the company’s network. That is how most food sites of 20 to 200 staff run their refrigeration too: a contractor fitted the controller, the contractor logs in to it remotely when an alarm goes, and nobody on site has ever seen the login page.

What a sign-in kiosk does about this: nothing

Before the rest, because this site sells a sign-in kiosk. The attacker never came to the door. A visitor and contractor sign-in system does not stop this, does not detect it, and does not evidence it. If any page on this site ever suggests otherwise, it is wrong. What a kiosk does contribute is further down, and it is small.

What CERT-FR told operators to do

The French alert gives one list for equipment that has not been compromised and a longer one for equipment that has. For the first case, translated from the alert as it read on 3 November:

1. Remove the internet exposure of the units concerned, and of every unit sitting on a public IP address.
2. Check your insurance terms before you cut the data link to your refrigeration contractor. The alert says this in so many words, because a policy may require continuous monitoring.
3. Check the whole configuration, the defrost ranges in particular.
4. Restore access only through a secure VPN or a protected network. Filtering the contractor’s source addresses on a firewall is an emergency measure, the alert says, not a lasting one.
5. Apply the maker’s good practice: update the firmware, set the security level to strict, make sure the default passwords have been changed.

For a device that has already been compromised the list adds a restart or a factory reset before reconfiguring it. Then the warning, which is the line to read twice: attack campaigns are probably still running, a device out of support that stays on the internet faces a very high probability of compromise, and a factory reset on its own is not enough, because the device remains vulnerable and will certainly be compromised again.

Seven questions for your refrigeration contractor this week

Not advice from me. I am not a cyber security assessor and not a refrigeration engineer. Each of these is CERT-FR’s list, and the NCSC’s description of the French attack, turned into a question you can ask by phone.

1. Is the admin page of our controller reachable from the public internet? Yes or no, and how do you know.
2. How do you reach it remotely: through a VPN, or by typing an address into a browser?
3. What model is it, what firmware is it running, and does the maker still support it?
4. Has the default password been changed? Is the security level set to strict?
5. What is the defrost cycle set to today, and would anybody be told if it changed to eight hours?
6. Who at your firm holds a login, and who answers the high temperature alarm at three in the morning?
7. Before we take the remote link down: what does our insurance say about continuous monitoring?

A yes to the first question is the one to act on today, and the authority to read is the NCSC, not this page.

The second door

Once the cabinets are cold again, the question a technical manager, an insurer or an auditor asks is the one that follows any incident: who could reach that controller, and can you show it? The controller has two doors. The network door is the contractor’s remote login and everything above. The other is the plant room door, and that one has a record on your site already, or it does not.

The food defence section of the BRCGS standard asks who could deliberately interfere with product and how you would know, and every answer to that starts with who was in the building and who let them in. ISO 27001’s physical entry control asks for a visitor log that is kept, protected and reviewed. Neither standard was written with a hacked defrost cycle in mind, and neither says a word about which door the attacker used. They ask for the record of the physical door regardless.

There is a test you can run on your own site today. List every refrigeration engineer who has been on site since 1 August, with the dates and who they saw. From a paper book that is an afternoon with a highlighter, if the book is still in the drawer and the handwriting can be read. From a sign-in kiosk it is an export for the dates you choose. That is the whole of what a sign-in system contributes to an incident like this: the physical half of the access record, kept somewhere it can be found. It does not make the controller safe and it does not make the site compliant with anything.

Where this lands for a UK meat plant

The Food Standards Agency audits every approved meat plant in England, Wales and Northern Ireland, and its own monthly file shows where plants already lose marks: five of the ten most-marked questions end with the same three words, “supported by records”. None of the 117 questions names a visitor or a contractor. Whether this month’s attacks add a question to anybody’s audit is not something I can predict, and this post does not try to.

What the kiosk records

For completeness, and only this. The kiosk records a name, a company, the host, the time in and the time out, and the site wording the person accepted, by hash. The history exports from the dashboard as a CSV of name, company, host, signed in and signed out in UK time, for whatever dates you choose. A visitor who forgets to sign out is closed automatically at 23:59 UTC, and the export shows that time, not a real exit, so the record is only as good as the sign-out habit. Nothing in it looks at your network, your controllers or your contractor’s login.