Critical Infrastructure Security,
Cyberwarfare / Nation-State Attacks,
Fraud Management & Cybercrime
A British Food Wholesaler Ripped Out Its Internet Connection During Cyberattack
The ongoing wave of cyberattacks targeting refrigeration facilities across Europe is raising serious alarms regarding their potential impact on the food supply chain. Reports are emerging of significant incidents, including a near miss in France involving the public blood bank and consequences felt in the UK food sector.
These malicious attacks, primarily aimed at operational technology systems in refrigeration, first became apparent in mid-October 2026. Reports revealed that a number of French supermarkets had to dispose of millions of euros worth of perishable goods after hackers remotely altered the temperatures of their cooling systems. This incident was not isolated; shortly afterward, similar disturbances were reported across several European countries, including Sweden, Germany, Romania, Belgium, Estonia, Finland, Ireland, Luxembourg, and the Netherlands. The threat was emphatically illustrated in an article detailing how “Fresh Hack Attacks Defrost Freezers at European Supermarkets” led to thousands of euros worth of losses.
As the vicious cycle of these cyberattacks continued, impacts began to ripple through the British food industry as well. Although officials confirmed that the repercussions were minimal, they nonetheless acknowledged ongoing vulnerabilities in the system. The National Cyber Security Center (NCSC) of the UK elaborated in a recent Guardian report that they are collaborating with various food suppliers, noting that a few meat processing firms were affected as their cold storage units began to heat up. Fortunately, these units were reported to be empty at the time, averting immediate disaster. However, one London-based fruit and vegetable wholesaler acted decisively by physically disconnecting their internet connection to prevent significant damage when threats were detected.
Tony Goodger, a spokesperson for the Association of Independent Meat Suppliers, commented on the situation stating, “When hackers target European supermarkets, a handful of our members who operate similar software systems can become collateral damage.” He highlighted that thus far, none of the affected companies lost any meat, but the situation serves as a sobering reminder about the vulnerabilities inherent in the food supply chain.
While the spoiled produce represented a troubling but relatively manageable issue, a more severe incident nearly unfolded in France. Reports indicate that one equipment supplier for the French Blood Establishment (EFS) experienced a significant cybersecurity breach. This incident raised temperature and defrosting thresholds in critical cold storage rooms housing blood products, vital for hospitals and medical manufacturing. Fortunately, swift action from an on-call technician who monitored the system allowed for the temperature control measures to be reinstated, averting a catastrophic outcome. EFS announced that prompt preventive measures were undertaken, including transferring stored products to secure facilities.
The operating company Coolworld, implicated in the refrigeration breach, acknowledged the incident and indicated that it involved a third-party component outside its direct control. Notably, this incident reflects broader systemic issues, as the French public blood service confirmed ongoing collaboration with the French national cybersecurity agency (ANSSI) to ensure the safety and integrity of their operations.
ANSSI’s computer emergency response team identified the probable cause behind the supermarket attacks: insufficiently secured remote controllers. Danfoss and Copeland were named among the suppliers whose controls may have facilitated this vulnerability. A representative from Copeland verified the issue, confirming that certain XWEB monitoring solutions experienced a cybersecurity vulnerability. The company has since reached out to its clients with enhanced cybersecurity protocols and guidance.
While the identity of the attackers remains obscure, experts from the threat intelligence organization Lupovis reported discovering probing activities affiliated with “bulletproof hosting” commonly linked to Russian operations. Sentinel Labs has indicated that Russia remains a plausible suspect amid claims from the U.S. Department of Justice regarding a previous attack on cooling systems in a Los Angeles meat-packing plant.
As discussions around these incidents continue, Thomas Regnier, representative for the European Commission emphasized the collective nature of these threats, stating, “these are not isolated incidents” as multiple meetings have been convened to strategize an effective response. He urged caution regarding attribution as the cyber threat landscape is multifaceted and constantly evolving.
The NCSC has circulated its 2026 annual review, projecting an “unprecedented rise in the number of cyber incidents,” a phenomenon attributed to the growing influence of artificial intelligence. The NCSC CEO Richard Horne encapsulated the increasing vulnerabilities within the infrastructure, noting that longstanding weaknesses are now exposed at an alarming pace due to advancements in technology.