LONDON, UNITED KINGDOM — A cyberattack that forced supermarkets across Europe to discard food after hackers interfered with refrigeration systems may be an early warning of much bigger disruptions, Britain’s cybersecurity chief has cautioned.
Richard Horne, head of the UK’s National Cyber Security Centre (NCSC), described the incidents involving supermarket refrigerators and freezers as “just the foothills” of a potentially much wider cybersecurity problem.
His warning comes after cyberattacks disrupted refrigeration equipment at supermarkets and other food businesses across several European countries, causing temperatures to rise and leaving retailers with spoiled or potentially unsafe products.
The incidents exposed weaknesses in ageing technology that businesses have continued using despite known security risks.
But Horne believes the danger could become significantly greater as artificial intelligence makes it easier for hackers to identify and exploit vulnerabilities across large numbers of connected systems.
The NCSC’s latest annual assessment warns that an AI-powered ransomware attack involving Britain’s critical national infrastructure is highly likely by 2028.
For supermarkets, food suppliers and other businesses relying on connected equipment, the message is increasingly difficult to ignore: a vulnerability in an ordinary piece of technology could eventually disrupt something much more important than a store’s refrigeration system.
Supermarket Fridges Become Unexpected Targets of Cyberattacks
The latest incidents emerged on November 2, when supermarket refrigeration and freezer systems across Europe were affected by suspected cyberattacks.
Businesses in countries including Sweden, Belgium, France and Ireland reported disruptions involving equipment used to preserve chilled and frozen products.
In some locations, refrigeration temperatures rose dramatically after attackers allegedly interfered with connected control systems.
The consequences were immediate.
Supermarkets had to remove products from affected refrigerators and freezers, assess whether food remained safe for sale and arrange replacements where necessary.
Some businesses were forced to discard significant quantities of inventory.
The affected equipment was not designed to serve as a traditional target for cybercriminals. Refrigeration systems are normally responsible for maintaining temperatures, monitoring equipment performance and helping stores manage energy consumption.
However, many modern systems are connected to digital networks, allowing operators and maintenance providers to monitor and adjust settings remotely.
That convenience can become a vulnerability when security protections are inadequate.
An attacker who gains unauthorised access to a refrigeration controller may be able to interfere with the equipment’s operation without physically entering the supermarket.
The incidents demonstrated how a digital intrusion can create physical damage and financial losses.
Richard Horne Says the Attacks Are Only the Beginning
Horne delivered his warning following a speech marking the release of the NCSC’s annual report.
He said the supermarket refrigeration incidents represented only an early indication of the disruptions that could become more frequent as hackers exploit weaknesses in older technology.
His concern extends beyond the individual businesses affected.
According to Horne, numerous vulnerabilities remain exposed across organisations and supply chains, creating opportunities for cybercriminals and other malicious actors.
He warned that the most serious short-term risk is a substantial increase in the volume of cyber incidents.
The concern is that attackers no longer need to develop entirely new methods to cause disruption.
In many cases, they can exploit weaknesses that organisations have known about for years but have failed to address.
Horne also criticised businesses for years of underinvestment in technology and cybersecurity.
He described the practice as doing technology “on the cheap,” arguing that organisations have continued relying on systems that are outdated, inadequately maintained or insufficiently protected.
His warning was particularly direct: businesses may eventually have to explain why they ignored known risks when those weaknesses result in empty supermarket shelves, power disruptions or companies going out of business.
What Actually Happened to the Supermarket Refrigerators?
The attacks involved interference with digital systems controlling refrigeration and freezer equipment.
These systems are commonly used to monitor temperatures and regulate cooling operations.
When unauthorised access is obtained, an attacker may be able to change settings that determine how equipment operates.
In the European incidents, some refrigeration units reportedly experienced dramatic temperature increases.
In Sweden, a supermarket’s freezer systems were reported to have reached approximately 50 degrees Celsius.
That is far above the temperatures required to preserve frozen products.
The incident forced the store to remove affected goods and assess the extent of the damage.
Other retailers across Europe also reported disruptions, with some removing chilled and frozen products as a precaution.
The incidents were particularly concerning because refrigeration failures can quickly affect food quality and safety.
Unlike ordinary retail products, perishable goods cannot simply remain on shelves while a technical problem is resolved.
When temperatures rise beyond acceptable limits, retailers may have to discard inventory even after the equipment has been restored.
The total financial cost of the latest wave of attacks has not yet been fully established.
The UK Was Also Affected, but Grocery Chains Were Not Directly Hit
Although the most visible incidents involved supermarkets in continental Europe, British authorities also identified cyber activity affecting parts of the country’s food supply chain.
Horne said there had been a small number of impacts involving refrigeration or freezer systems in the United Kingdom.
However, the National Cyber Security Centre indicated that no major UK supermarket chain had been directly affected by the same type of disruption reported across European retailers.
Some independent food suppliers and businesses were among those affected.
British authorities worked to alert organisations with exposed technology and potential vulnerabilities.
The distinction is important because the UK has not experienced the same level of supermarket disruption reported elsewhere in Europe.
Nevertheless, the incidents demonstrate that the underlying cybersecurity weaknesses are not confined to one country.
Food suppliers, storage businesses and retailers all depend on connected equipment that can become a target if security arrangements are inadequate.
Why Older Technology Is Creating Serious Security Risks
One of the central issues identified by cybersecurity specialists is the continued use of outdated technology.
Many refrigeration systems were installed years ago, before cybersecurity became a major consideration in the design and management of commercial equipment.
Some older systems may no longer receive regular security updates.
Others may still use weak passwords, outdated software or internet connections that expose their control interfaces to potential attackers.
These weaknesses can remain unnoticed for long periods because the equipment continues performing its everyday function.
A supermarket may have no obvious reason to replace a refrigeration controller that appears to be working normally.
However, a system that operates correctly is not necessarily secure.
When outdated equipment is connected to the internet or a wider corporate network, attackers may be able to identify vulnerabilities and attempt to gain access.
The problem becomes more serious when the same equipment or software is used across multiple locations.
A weakness affecting one model of controller could potentially expose several businesses using similar technology.
This is why cybersecurity specialists are urging organisations to treat operational technology as an essential part of their security planning.
Artificial Intelligence Could Make the Threat Much Worse
Although AI was not needed to carry out the supermarket refrigeration attacks, Horne warned that artificial intelligence could significantly increase the scale and speed of future cyber operations.
The technology can help attackers identify vulnerabilities, analyse systems and automate parts of the process involved in exploiting security weaknesses.
This does not necessarily mean AI will invent entirely new forms of cybercrime.
Instead, it could make existing techniques faster, more efficient and easier to deploy across large numbers of targets.
A vulnerability that might previously have required extensive manual investigation could potentially be identified and exploited at a much greater scale.
Horne stressed that the problem is not simply that AI creates new ways to attack organisations.
It is that weaknesses tolerated for years may now become easier to discover and exploit.
For businesses operating large networks of connected equipment, this could increase the risk of widespread disruption.
A security flaw in one system may no longer remain an isolated problem if attackers can identify similar weaknesses across an entire industry.
NCSC Warns of AI-Powered Ransomware by 2028
The NCSC’s annual report contains a particularly concerning assessment about the future of cyber threats in Britain.
The agency said it was highly likely that the United Kingdom would experience an AI-powered ransomware cyberattack involving critical national infrastructure by 2028.
Ransomware typically involves malicious software that prevents organisations from accessing their systems or data, often accompanied by demands for payment.
An attack affecting critical infrastructure could have consequences extending far beyond the immediate victim.
Potential targets include essential services and systems supporting electricity, transport, communications, healthcare and other important sectors.
If an organisation cannot access the technology needed to operate, the consequences may include interrupted services, financial losses and wider disruption.
The NCSC’s warning does not mean that a particular attack has been scheduled or that a specific organisation will be targeted.
It reflects the agency’s assessment of the growing threat posed by increasingly capable cyber operations.
The supermarket incidents provide a practical example of how weaknesses in connected equipment can create physical and economic consequences.
Why Critical Infrastructure Is Particularly Vulnerable
Critical infrastructure depends on complex systems that must operate continuously.
Electricity networks, water facilities, transport systems, telecommunications and industrial operations all rely on technology to monitor and control essential processes.
Some of these systems use operational technology that was originally designed for reliability and long-term operation rather than protection against modern cyber threats.
Upgrading such equipment can be difficult.
Organisations may have to maintain systems that cannot easily be switched off without affecting essential services.
Replacing old equipment can also require substantial investment, specialised expertise and careful planning.
As a result, some businesses continue using technology that has reached the end of its support period.
The problem is not limited to the equipment itself.
Poor network separation, inadequate access controls and weak passwords can also expose important systems to unauthorised access.
The supermarket incidents demonstrate why organisations must consider the security of equipment that may not traditionally be viewed as part of their IT infrastructure.
UK Cybersecurity Chief Criticises Years of Underinvestment
Horne’s comments also addressed a longstanding problem in Britain’s technology and cybersecurity sector.
He argued that too many organisations and supply chains have relied on inexpensive technology solutions without investing sufficiently in long-term security.
Businesses may delay upgrades because of cost, operational difficulties or the belief that their existing systems are unlikely to be targeted.
However, this approach can create vulnerabilities that become increasingly expensive to address.
A supermarket that loses large quantities of frozen food may face replacement costs, operational disruption and damage to customer confidence.
A food supplier experiencing a similar incident could face even wider consequences if storage facilities or distribution operations are affected.
The same principle applies to other industries.
A business that delays security upgrades may eventually face costs far greater than the investment required to maintain its systems.
Horne warned that organisations could be forced to explain why they ignored known warning signs if those weaknesses eventually contribute to serious disruptions.
Russia, Iran and China Also Feature in Britain’s Cybersecurity Warning
The NCSC report also addressed the broader geopolitical cybersecurity environment.
Horne said Russia was making sustained efforts to penetrate British military networks.
He also said Iran was conducting malicious cyber operations internationally, including activity targeting the United Kingdom.
China was identified as a particularly significant long-term challenge.
Horne said China had the intent and capability to use artificial intelligence in operations against Britain’s critical national infrastructure and other strategic targets.
He described the country’s cyber activity as the most sophisticated and sustained challenge facing the UK.
These statements represent the British cybersecurity agency’s assessment.
Russia, China and Iran have repeatedly rejected similar accusations of hostile cyber activity.
The supermarket refrigeration incidents have not been publicly attributed to any of these governments.
Authorities have not established who carried out the attacks or whether they were connected to a state-sponsored operation.
The distinction is important because the existence of geopolitical cyber threats does not automatically establish responsibility for a particular incident.
Why the Food Supply Chain Is an Attractive Target
The attacks have raised concerns about the security of the wider food industry.
Supermarkets depend on a complicated network of suppliers, warehouses, refrigeration facilities and transport operators.
Food must be stored and transported under appropriate conditions before it reaches customers.
A disruption affecting one part of this network can create additional pressure elsewhere.
For example, a supermarket that loses refrigerated inventory may need replacement products from suppliers.
If several businesses experience similar problems at the same time, replacement stock may become more difficult to arrange.
Food suppliers could also face additional costs if they need to change delivery schedules or find alternative storage arrangements.
This does not mean that Europe is facing an immediate food shortage because of the refrigeration incidents.
Rather, the attacks demonstrate how digital disruptions can create problems throughout an interconnected industry.
The issue is particularly important for smaller businesses that may have fewer financial and technical resources available to respond to a cyber incident.
WWC ONE MEDIA previously examined the initial wave of supermarket refrigeration attacks in Hackers Target Supermarket Fridges Across Europe — Could Food Supply Chains Face a Bigger Cyber Threat?.
That report explored the affected retailers, the damage to food inventory and the vulnerabilities associated with remotely managed refrigeration equipment.
Horne’s latest warning adds a wider national-security dimension to the story, suggesting that the same weaknesses could become part of a much larger wave of cyber disruption.
What Businesses Can Do to Reduce the Risk
Cybersecurity specialists have repeatedly stressed that organisations do not necessarily need futuristic technology to address many of the weaknesses exposed by these incidents.
Basic security measures can make a significant difference.
1. Update outdated software and firmware.
Businesses should ensure that connected equipment receives available security updates. Systems that no longer receive support should be reviewed for replacement or additional protection.
2. Restrict internet access to operational equipment.
Refrigeration controllers and other industrial systems should not be unnecessarily exposed to the public internet.
Secure remote access arrangements can reduce the risk of unauthorised connections.
3. Replace default and weak passwords.
Equipment should use strong, unique credentials rather than factory-default passwords that may be widely known.
4. Separate operational technology from ordinary business networks.
Network separation can help prevent an attacker who compromises an office computer from gaining access to equipment controlling physical operations.
5. Monitor unusual system activity.
Businesses should establish procedures for detecting unexpected changes in equipment settings, temperatures and network traffic.
6. Prepare emergency response plans.
Retailers and food suppliers need clear procedures for responding to refrigeration failures, cyber incidents and the possible loss of perishable inventory.
These measures cannot eliminate every threat, but they can make it more difficult for attackers to gain access and cause widespread disruption.
The Cybersecurity Challenge Extends Beyond Supermarkets
The refrigeration incidents are part of a broader shift in how cyberattacks can affect everyday life.
Traditional cybercrime often focused on stealing personal information, compromising financial accounts or disrupting websites.
However, attacks involving operational technology can directly affect physical processes.
A compromised industrial system may interfere with machinery, heating, cooling, manufacturing or other essential operations.
This creates a different level of risk because the consequences are no longer limited to data loss.
A disruption to electricity infrastructure could affect households and businesses. An attack on transport systems could interrupt services. A breach involving food storage could damage products before they reach supermarket shelves.
The increasing use of connected devices means that more physical equipment is becoming part of the digital environment.
That creates new opportunities for efficiency, but it also expands the number of systems organisations must protect.
What Happens Next?
The NCSC is continuing to monitor the situation and work with organisations that may be exposed to similar vulnerabilities.
Businesses across the food supply chain will need to review their refrigeration equipment, network connections and security arrangements.
The government will also face growing pressure to ensure that organisations responsible for essential services are adequately prepared for more sophisticated cyber threats.
The NCSC’s warning about AI-powered ransomware by 2028 adds urgency to the issue.
The supermarket incidents show that even relatively basic attacks can create significant financial losses when businesses rely on outdated and poorly secured technology.
The next challenge is ensuring that organisations do not wait for a much larger incident before investing in protection.
The Bottom Line
The hacking of supermarket refrigeration systems across Europe has become a warning about the growing vulnerability of connected infrastructure.
What appeared to be an unusual attack on supermarket fridges has exposed a much broader problem: organisations continue to depend on ageing technology, weak security arrangements and systems that may no longer receive essential updates.
Britain’s cybersecurity chief Richard Horne says these incidents are only the beginning of what could become more frequent and disruptive attacks.
The NCSC is particularly concerned that artificial intelligence will help malicious actors identify and exploit existing vulnerabilities on a much larger scale.
Its latest assessment warns that an AI-powered ransomware attack involving British critical infrastructure is highly likely by 2028.
The refrigerator attacks themselves were not AI-powered, and investigators have not established who was responsible. But they demonstrate how a digital weakness can lead to real-world consequences, including spoiled food, financial losses and interrupted business operations.
For governments, the challenge is protecting essential services. For businesses, it is making cybersecurity a necessary investment rather than an expense that can be postponed.
If hackers can remotely interfere with supermarket refrigerators today, how prepared will Britain’s electricity networks, transport systems and other critical services be when AI makes cyberattacks faster and easier to scale?
