What happened?
On the night of 11 to 12 October 2026, refrigeration systems in more than 200 French supermarkets were switched into defrost, and stores including Intermarché and Coopérative U outlets had to discard fresh and frozen food.
On 1 and 2 November a second wave hit stores in Belgium, Luxembourg and Sweden. Ahold Delhaize told CNBC that food had to be discarded in dozens of its Belgian stores, and TechCrunch reported that Colruyt, ICA and Coop were also affected.
In the UK, the National Cyber Security Centre (NCSC) commented on the attacks on 3 November at the launch of its annual report. Paul Chichester, its Director of Operations, said the NCSC was working with the affected organisations and that “at the moment, the impact is minimal”, ITV News reported. The UK organisations affected so far were meat processing firms rather than major supermarket chains.
Why is remotely managed equipment exposed?
Fridges, freezers, building management systems and industrial controls are increasingly managed remotely, so engineers and suppliers can monitor and adjust them without a site visit. This equipment, known as operational technology (OT), controls physical processes, and it often stays in service for many years.
According to ITV News, the French attacks involved legacy technology connected to the internet with default passwords. UK Cyber Defence identified more than 800 refrigeration and building-management controllers in the UK with management interfaces reachable from the public internet. A publicly reachable interface gives attackers a point to probe for weaknesses, even where a login is required.
Speaking at the same launch, NCSC chief executive Dr Richard Horne listed heating and refrigeration controls among the systems that, while not seen as traditional IT, “are not built on the strong foundations they require”.
What Northdoor says
AJ Thompson, Chief Commercial Officer at Northdoor, said:
“The supermarket freezer attacks show how quickly a cyber attack can disrupt physical operations. Changing a setting remotely can be enough to ruin stock or interrupt a service.
“Operational technology is often installed to do one job and stays in use for years. Remote access can make it easier to monitor and maintain that equipment, but security doesn’t always keep pace. Organisations can lose track of what’s connected, who has access and who’s responsible for securing it.
“Start with the equipment that would interrupt operations if it stopped working or its settings were changed. Find out which systems can be accessed remotely, who has access and who is responsible for securing them. Then remove any internet exposure you don’t need and review how you protect the remote access you rely on.”
Practical checks
- List the equipment that would stop operations if it failed or its settings changed: refrigeration, heating and ventilation, building management, production lines.
- Find out which of those systems can be reached remotely, and whether any management interface is visible from the public internet.
- Ask which suppliers and contractors have remote access, how they connect and how that access is reviewed. Supplier access is part of your third-party risk.
- Change default passwords, and require multi-factor authentication for remote access wherever the equipment supports it.
- Take anything off the internet that does not need to be there, and put the rest behind controlled access in line with zero trust principles.
What this means for your organisation
Most organisations have some equipment managed remotely by a supplier, and many cannot say how it is connected. The attacks show why it’s worth checking how remotely managed equipment is connected and who can access it. Our supply chain security monitoring and managed security services help organisations see and reduce that exposure. For the wider picture on acting on NCSC warnings, see When the NCSC says act now, boards should listen, or talk to us.