Hackers Cranked UK Meat Supplier Freezers to 100C in Europe-Wide Cyberattacks

Hackers pushed one UK meat supplier's cold storage units to 100C as part of a wave of cyberattacks that hit refrigeration systems across European supermarkets, the British Association of Independent Meat Suppliers (Aims) told the BBC. Two more Aims members reported their units had started to defrost. The affected units were empty at the time, so no produce was lost.

The attacks struck retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden on Monday, with some supermarket fridges heating to as high as 50C (122F). Several companies confirmed they had been hacked. The campaign follows similar incidents in France last month, where attackers compromised supermarket fridges running legacy technology connected to the internet with default passwords still in place.

What does this change for UK suppliers?

No UK grocery chain has been directly affected so far, and the UK's National Cyber Security Centre (NCSC) says the national impact is minimal. But Aims, which represents more than 300 independent meat suppliers, has confirmed members are in the firing line.

Paul Chichester, the NCSC's director of operations, said at the launch of the centre's annual review on Tuesday: "We're aware of those incidents in the UK, and obviously we're working with the affected organisations. We'll keep monitoring that. At the moment, the impact is minimal."

The NCSC, part of the GCHQ spy agency, is now working with organisations to find similar loopholes in their technology and close them before hackers exploit them. For meat suppliers and food logistics operators, that means auditing any internet-connected refrigeration controls — especially older kit still running factory credentials.

Chichester said the NCSC could not comment on who might have carried out the attacks. He did rule out AI enablement, saying the attackers had used vulnerabilities that had been "out there for a long period of time."

Who is behind the fridge attacks?

Cybersecurity researchers have connected the probing activity to infrastructure previously tied to Russia. Lupovis, a cyberdefence firm, set up online "honeypot" traps — dummy Danfoss fridge controllers indistinguishable from the real controllers targeted in mainland Europe.

Between 20 October and 30 October, Lupovis recorded 256 attempted attacks from 91 different sources. Most of the authentication attempts used Danfoss's publicly documented factory-default username and password.

Xavier Bellekens, Lupovis's chief executive, said the attackers also used "bulletproof" hosting — internet service providers that tolerate malicious activity, ignore abuse complaints or make it difficult for authorities to disrupt their customers' operations.

"What caught our attention was the overlap between infrastructure involved in the recent probing activity and infrastructure we have previously associated with Russian-linked malicious operations," Bellekens said.

"While we are not able to pinpoint a group yet, the number of actors that fit this bill is relatively small and the bulletproof hosting we have seen being used by these actors for probing was also being used by Russian groups some time ago," he added.

The bigger picture: cheap flaws, growing threat

NCSC chief executive Richard Horne framed the fridge attacks as the "foothills" of an enlarged cyberthreat facing companies and the public, as AI systems surface flaws in IT networks that owners either didn't know about or neglected to patch.

"There are so many vulnerabilities out there that … you could say are waiting to be exploited," Horne said.

Ollie Whitehouse, the NCSC's chief technology officer, said everyday domestic devices connected to the internet would remain susceptible to hackers in certain situations. His prescription: manufacturers need encouragement to build safer technology, and consumers need to accept paying more for safer equipment.

The practical takeaway for food-sector operators is blunt. The attacks required no AI, no zero-days and no sophistication — just default passwords on internet-connected kit. Until manufacturers ship hardened devices and buyers pay for them, cold-chain equipment with factory credentials remains a cheap, proven target.