A series of cyberattacks has hit refrigeration systems across Europe, with British meat suppliers and a fruit and vegetable wholesaler among the latest victims. These incidents, following an earlier wave in France, exploited known vulnerabilities in industrial control systems, leading to widespread defrosting and potential stock spoilage. ### Exploiting Known Vulnerabilities The **Association of Independent Meat Suppliers (AIMS)** confirmed that three of its members were attacked through vulnerable **Copeland XWEB** supervisory controllers. A spokesperson for **Copeland** acknowledged that certain XWEB monitoring solutions are impacted and stated that recommended patching and security protocols have been re-communicated to customers. **Tony Goodger**, an AIMS spokesperson, described the affected members as "collateral," running the same susceptible software. While no meat was lost in these specific incidents, Goodger emphasized that the events serve as a stark reminder for the entire food industry about potential targeting. **Langridge Organic**, a British fruit and vegetable wholesaler, also reported an attack. Managing Director **Alex Pearce** recounted interrupting a live hacking event by physically disconnecting a fridge from the internet after observing it being remotely put into defrost mode. His team's quick physical intervention prevented any stock spoilage. The British suppliers were reportedly using temperature controllers with firmware versions (1.12.1 and earlier) that contained "severe authentication bypass vulnerabilities," allowing attackers to gain control without a password. A firmware update addressing these flaws has been available since August, following disclosures by industrial cybersecurity company **Claroty**. ### NCSC Assesses "Minimal" National Impact, Warns of Broader Threats Britain’s **National Cyber Security Centre (NCSC)** is aware of the attacks and is assisting affected organizations. **Paul Chichester**, NCSC's Director of Operations, stated that the national impact has been "minimal" thus far, with staff proactively contacting companies with exposed vulnerable systems. However, **Richard Horne**, NCSC's Chief Executive, highlighted the severe impact on individual businesses, stating that "if you’re running the business that’s been hit by that, it is an enormous issue for you and your employees and everyone else." Horne also noted that these attacks are merely "the foothills" of a larger threat, aligning with the NCSC's recent annual report warning of an "unprecedented rise in the number of cyber incidents" due to a failure to implement basic cyber protections. **Ollie Whitehouse**, NCSC's Chief Technology Officer, expressed surprise at finding such systems still connected to the internet in 2026, despite years of warnings. ### Calls for Enhanced Critical Infrastructure Designation AIMS is advocating for the food sector to be given a stronger designation within Britain’s critical national infrastructure framework. Currently, individual food sector assets are not designated as critical, leaving them outside the scope of the forthcoming **Cyber Security and Resilience Bill**. This bill would mandate essential service operators to maintain appropriate security measures, such as prompt patching, or face significant fines. In contrast, the European Union’s **NIS2** legislation already covers food production and distribution, though its broad scope has drawn some criticism for potentially including a wide array of businesses.