UK Meat Firms Join Europe’s Freezer Cyberattack Wave

One UK meat company found its refrigeration temperature had climbed to 100°C. Two other meat suppliers reported equipment defrosting, but all affected units were empty, so no food was lost, the British Association of Independent Meat Suppliers said. The incidents bring Britain’s food supply chain into a wave of attacks on refrigeration systems across Europe. ¹

The British suppliers’ problems surfaced after retailers in seven European countries reported refrigeration failures on Monday. Some units switched to defrost mode or were set to 50°C, forcing stores in parts of Europe to discard chilled and frozen food. The UK’s National Cyber Security Centre said it was working with affected firms and helping them find and fix weaknesses. Its operations director, Paul Chichester, said the attacks used known flaws and were not linked to artificial intelligence. ^1,2

Those known flaws matter because remote controls can turn a routine cooling system into a way to spoil food and disrupt businesses. Researchers at Lupovis recorded 256 attempts to access test refrigeration controllers between 20 and 30 October, using 91 different sources. Many login attempts used factory usernames and passwords that are publicly available. Lupovis chief executive Xavier Bellekens said some attempts came through systems previously linked to malicious activity associated with Russia, but researchers have not identified a specific group.¹ Across Europe, the attacks have affected retailers and prompted warnings about food losses and poorly protected equipment. Investigators have not confirmed who carried them out. ^2,3

That uncertainty leaves food firms with a clear task: secure systems that can be reached remotely, especially older equipment with default passwords. The UK cyber centre is monitoring events and helping affected companies fix weaknesses. European authorities are also working together, while national investigations continue. For the British meat suppliers, the immediate loss was avoided because the units were empty; the wider risk is that the next affected system may not be. ^1,3