Key Takeaways
- Attackers remotely took control of refrigeration systems at supermarkets across Europe in October and November 2026, and three UK meat suppliers were also affected.
- Investigators linked the attacks to older controllers that no longer received security updates, some reportedly exposed to the internet with default passwords.
- The NCSC’s Annual Review 2026 warns that AI is making it faster and cheaper to find and exploit weaknesses in old technology.
- The basics that would have reduced the risk, such as changing default passwords and replacing unsupported kit, are the same ones Cyber Essentials covers.
On this page
How many devices in your organisation are connected to the internet that nobody thinks of as IT?
Last week, that question stopped being theoretical. Supermarkets across Europe found their fridges and freezers warming up overnight after attackers remotely changed their settings. Food was thrown away, shelves were emptied, and retailers counted the cost in millions.
The following day, the UK’s National Cyber Security Centre (NCSC) published its Annual Review 2026. One of its starkest warnings is that AI-powered ransomware is highly likely to hit UK critical national infrastructure by 2028.
The two stories point to the same lesson. The weaknesses being exploited are rarely new. AI is simply making them easier to find.
What happened in the supermarket fridge attacks?
The first attacks hit supermarkets in France in mid-October 2026. A second, wider wave followed overnight into 2 November, affecting stores in countries including Belgium, Sweden, Ireland, Estonia and the Netherlands.
Attackers remotely changed settings on refrigeration controllers, raising temperatures or switching units into defrost mode. Retailers had to pull stock from shelves, and the cost of spoiled food ran into millions.
What matters most for other organisations is how the attackers got in:
- Unsupported equipment. The manufacturers involved said most affected systems were older products that no longer received security updates.
- Basic exposure. According to the NCSC’s CEO, Richard Horne, the French systems were connected directly to the internet with default passwords.
- Third-party management. At least one retailer said the affected stores used an outside supplier, with the systems sitting outside its central network.
No group has claimed the attacks, and investigations are ongoing. But none of these weaknesses required a sophisticated, previously unknown exploit.
What did the NCSC Annual Review 2026 warn about?
The NCSC Annual Review 2026, published on 3 November, judges it highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. “Highly likely” is the NCSC’s language for a high-confidence forecast, not a confirmed event.
The wider message is just as important. Richard Horne says the UK’s cyber resilience is not yet where it should be, because the threat has grown faster than our defences. He is also clear about AI’s role: it did not create today’s weaknesses, it revealed them. The NCSC expects AI to make attacks faster, larger in scale and cheaper to run.
Speaking about the fridge attacks, Horne described them as just the beginning, because AI can now find and abuse weaknesses in old technology.
Why do old connected devices matter so much?
Most organisations have devices like these. They are just not always on anyone’s list.
Think about building management systems, CCTV, door entry, heating controls, printers or equipment installed and maintained by a supplier. These devices are often set up once and left alone for years. They may still use the default password, run software the manufacturer no longer supports, or be reachable from the internet so an engineer can manage them remotely.
That used to be a risk many organisations could live with, because finding these devices took time and effort. AI changes that. If attackers can scan for and exploit old weaknesses faster and more cheaply, forgotten equipment becomes a far more attractive way in.
So what does this mean for you? The question is no longer whether your critical systems are secure. It is whether you know about everything that is connected, including what your suppliers manage on your behalf. An OSINT assessment can show you what an attacker can see from the outside.
Where does Cyber Essentials fit?
The weaknesses reported in the fridge attacks are exactly the kind of basics Cyber Essentials is designed to address:
- Secure configuration requires default passwords to be changed.
- Security update management requires software to be supported and patched, and unsupported software to be removed or replaced.
- Firewalls control which services are exposed to the internet.
The government recommends Cyber Essentials for UK organisations of all sizes, and the NCSC review repeats that message. It is a minimum standard, though, not a finish line. Self-assessment shows you have the right controls on paper. Cyber Essentials Plus adds hands-on testing to check they work in practice.
If you are working towards certification, OmniCyber’s guide to what could catch you out under Danzell covers the scoping and patching questions that trip organisations up most.
What should organisations do now?
Start with what you can see, then make sure it stays that way:
- List every connected device, including building systems, operational equipment and anything installed by a supplier.
- Change default passwords on every device and management interface.
- Take management interfaces off the open internet, or put them behind a VPN or other secure remote access.
- Identify unsupported equipment and plan to replace or isolate it.
- Ask suppliers how they secure and update the systems they manage for you, and how they access them remotely.
- Check your external exposure regularly, not just once. Vulnerability scanning can make this part of routine work.
None of these steps needs new technology. They need someone to own them.
Foundations first, then keep testing them
A supermarket fridge is not where most people expect a cyber attack to start. That is exactly the point. The NCSC’s warning is not that attackers have found something new, but that AI is helping them find what has been there all along.
The organisations best placed for what comes next are the ones that know what they have connected, get the basics right, and keep checking that those basics hold.
Start with the basics. Our certified assessors can help you achieve Cyber Essentials, then prove your foundations hold with Cyber Essentials Plus.
Ready to achieve your security goals? We’re at your service.
expertise to help you shape and deliver your security strategy.
About the author
