The refrigeration controller attacks that hit more than 115 European stores overnight on 1 to 2 November also reached the United Kingdom, and they went beyond supermarkets. On 3 November, Britain's National Cyber Security Centre (NCSC) said it was aware of "a couple of instances" in the UK food supply chain where vulnerable technology had been exploited. NCSC chief executive Dr Richard Horne told BBC Radio 4 that staff had "worked through the night" to alert organizations with exposed, vulnerable equipment, adding: "It's not just supermarkets, it's through the whole food supply chain."
The Red Tiger team published the French wave on 22 October and the wider European wave on 2 November. We are flagging this update because it confirms the attacks have moved into food processing and wholesale sites, which are industrial facilities, and because the equipment vendor has now confirmed which product line is affected.
The Association of Independent Meat Suppliers (AIMS) told The Record that three of its members were attacked through Copeland XWEB supervisory controllers, the networked units that monitor and adjust cold rooms and freezers. A Copeland spokesperson confirmed that certain XWEB monitoring products are affected and said the company has re-sent its recommended patching and security guidance to customers. According to a security note shared among AIMS members, XWEB firmware version 1.12.1 and earlier contains authentication bypass flaws, meaning someone can take control without a password, and a firmware update has been available since August. The Record also reports that researchers at Claroty disclosed almost two dozen vulnerabilities in Copeland XWEB Pro controllers in August.
AIMS said the affected cold units were empty, so no meat was lost. London produce wholesaler Langridge Organic told The Grocer that its managing director physically unplugged a fridge from the internet after watching it being put into defrost mode, and no stock was spoiled. The NCSC said national impact is minimal so far, that the attacks were not sophisticated, and that they use vulnerabilities that have been public for a long time. No group has claimed the attacks and UK authorities have not attributed them.
Food and beverage plants, meat and dairy processors, cold storage warehouses, pharmaceutical cold rooms and port reefer yards run the same class of refrigeration supervisor. These units are usually installed and supported by a refrigeration contractor, reached from outside over a public address or cellular modem, and left out of the operational technology (OT) asset inventory. The NCSC's chief technology officer said the agency was surprised to see such devices still connected to the internet in 2026 despite earlier warnings. If a national agency can find your exposed controller overnight, so can an attacker.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources: The Record (3 November 2026) https://therecord.media/british-businesses-caught-in-europe-wide-supermarket-fridge-attacks ; BBC News (3 November 2026) https://www.bbc.co.uk/news/articles/ckq6ndq8l6v0o ; The Grocer (3 November 2026) https://www.thegrocer.co.uk/news/meat-suppliers-hacked-in-latest-round-of-fridge-cyberattacks/725432.article ; The Independent (3 November 2026) https://www.independent.co.uk/news/uk/home-news/uk-freezers-europe-cyber-hack-ncsc-b3078173.html ; CERT-FR alert CERTFR-2026-ALE-012 https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/
Check out our resources and book a follow-up call with our team.
