EU food security not at risk after refrigeration incidents, commissioner says

A suspected cyber-attack on supermarket refrigeration systems across seven European countries has renewed concern about the security of internet-connected equipment — from shop freezers to industrial machinery and household appliances.

The incidents do not show that ordinary domestic devices are being targeted, or that every connected system can be taken over. But researchers have identified more than 800 refrigeration and building-control interfaces linked to British retailers that are accessible over the public internet. That does not mean they can be hacked; it could expose them to attackers exploiting weak passwords or software flaws.

The UK’s National Cyber Security Centre said it was working with international partners and industry to understand the supermarket incidents, and was unaware of any impact on the UK. The British Retail Consortium has described cyber incidents as a major concern for retailers.

From freezers to infrastructure

A device’s internet connection can make it easier to monitor and control remotely, but it can also create a route for attack. Cyber-security researcher Tom Hegel said retailers needed to establish who was responsible for securing equipment, not just repairing it. If an attacker can change its controls, he said, a legitimate function such as defrosting could be used to disrupt operations and damage stock.

The risks are not confined to shops. Connected systems help manage vehicles, industrial machinery, power plants and water networks. Security expert Ken Munro said UK utilities were generally good at protecting these connections, while warning that standards varied internationally and smaller operators might still rely on older equipment.

Past demonstrations show what can go wrong: researchers exposed a vulnerability in a Samsung smart fridge in 2015, and remotely hacked a Jeep through its internet-connected entertainment system. The vehicle industry subsequently improved security. These examples do not establish that the current supermarket incidents involved the same weaknesses.

The attacks also come after ransomware disrupted UK retailers M&S and the Co-op in 2025, affecting fresh deliveries and leaving some shelves empty. The earlier incidents involved retailers’ systems; they do not demonstrate that refrigeration equipment was compromised.

Since April 2024, UK law has required manufacturers of certain consumer smart devices to meet minimum cyber-security standards, including rules on passwords and security updates. Former NCSC chief executive Ciaran Martin said manufacturers needed to do more to provide safer products. He advised consumers to install updates and use multi-factor authentication where available.

Update

EU Agriculture and Food Commissioner Christophe Hansen said on 2 November that the attacks were a deliberate attempt to disrupt the EU’s food supply and undermine consumer confidence, Reuters reported. He said food security was not currently at risk, but that food waste and the impact on businesses were real.