10th November 2026
The honest answer is that we cannot assume British supermarkets are any safer than their French counterparts. The French incidents should be a warning to the entire retail industry, not simply a problem for French supermarket operators.
There is an important distinction here. A supermarket can have excellent protection for its tills, payment systems and customer databases, yet still have weaknesses in the technology controlling its refrigeration, heating, ventilation and other equipment.
That is because modern supermarkets are increasingly dependent on connected technology. The very systems that help keep food fresh, reduce electricity consumption and monitor temperatures can also create new opportunities for cyberattacks.
The worrying discovery: Britain already has more than 800 exposed refrigeration controllers
There is a particularly important development here.
An investigation reported by The Grocer on 13 October 2026 found that more than 800 refrigeration and building-management controllers in the UK were accessible through the public internet.
The research was conducted by cybersecurity specialists UK Cyber Defence.
These controllers are computers built into refrigeration and building systems. They allow engineers to monitor temperatures, change settings and carry out maintenance remotely.
The problem is that some of these systems can be found by anyone searching the internet. That does not automatically mean they can be hacked, but it gives potential attackers an opportunity to look for weak passwords, outdated software and other vulnerabilities.
The research identified equipment from several manufacturers, including Danfoss, Carel and Copeland. Only 15 of the identified UK devices were Danfoss units, the manufacturer associated with the French incidents. The wider problem is therefore not confined to one manufacturer.
This is an important distinction: Britain may have avoided the particular French attack, but that does not mean its supermarket refrigeration infrastructure is secure.
How did the French attack work?
The October attack in France affected hundreds of supermarkets, with subsequent reporting putting the number above 700.
Investigators identified weaknesses in refrigeration controllers, including older equipment that had not received necessary security updates.
The attackers were able to access the control systems and change the defrost settings. Instead of operating normally, some freezers were effectively put into prolonged defrost cycles.
Temperatures rose dramatically, with some reaching around 50°C. Food was lost and equipment was damaged.
The worrying part is that this was not necessarily a sophisticated attack against a supermarket's main computer network. It exploited relatively ordinary equipment that had been connected to the internet without adequate protection.
Le Monde.fr+1
Why Britain should be concerned
There are four particular issues.
1. Contractors can create security weaknesses.
Supermarkets often employ specialist refrigeration contractors. Remote access makes maintenance quicker and cheaper, but a contractor connecting equipment directly to the internet can inadvertently create an opening for hackers.
2. Old equipment may still be operating.
Commercial refrigeration systems can remain in service for many years. Some may be running software that no longer receives security updates.
3. The supermarket's own IT department may not know about every device.
The UK investigation suggested that some controllers were installed on separate broadband or mobile connections rather than the supermarket's main corporate network. This makes it possible for equipment to fall outside the retailer's normal cybersecurity monitoring.
4. The consequences extend beyond financial losses.
Refrigeration failures can affect food safety, availability and supply chains. If a large number of stores were affected simultaneously, the consequences could extend well beyond the individual supermarkets.
The recent European incidents demonstrate that this is not simply a theoretical risk. Sweden, Belgium, Luxembourg and other countries have also experienced problems.
Reuters+1
Have British supermarkets been affected?
There is an important development which makes the situation more concerning.
By 3 November, the UK had not reported a major supermarket-chain incident comparable with those in France and Scandinavia. However, British food businesses had not escaped entirely.
The Association of Independent Meat Suppliers reported that three UK members had been affected by attacks involving Copeland refrigeration monitoring equipment. A British fruit and vegetable wholesaler also reported an incident.
The National Cyber Security Centre (NCSC) confirmed that it was aware of incidents affecting UK organisations and was working with those involved. It described the impact at that stage as limited.
The British Retail Consortium has also said that retailers are working with the NCSC to strengthen protection.
That is reassuring to an extent, but it is not proof that every supermarket has secured its equipment.
What should supermarkets be doing?
The NCSC has issued guidance covering precisely these types of industrial control systems.
The important measures include:
- Removing refrigeration controllers from direct exposure to the public internet.
- Replacing default and shared passwords.
- Installing security updates and replacing equipment that is no longer supported.
- Restricting remote access to authorised engineers.
- Separating refrigeration controls from ordinary business computer networks.
- Monitoring temperature changes and unusual remote access.
- Maintaining independent temperature alarms and emergency procedures.
These are not particularly exotic cybersecurity measures. They are established practices, and the NCSC has been warning organisations about internet-connected operational technology.
What about customers? How would we know?
This is where transparency becomes important.
Customers cannot realistically inspect a supermarket's computer systems. Nor should they have to.
But supermarket operators should be able to answer some straightforward questions:
1. Have all refrigeration controllers across their stores been identified and independently checked?
2. Are any still accessible directly from the public internet?
3. Have all known security vulnerabilities been patched?
4. Are older systems being replaced?
5. Can staff detect an unauthorised temperature change quickly, including overnight?
6. Are there independent safeguards if the computer controlling a freezer is compromised?
There is also a food safety question. Supermarkets need to ensure that products exposed to unsafe temperatures are not subsequently sold simply because refrigeration has been restored.
I would like to see the major UK supermarket groups publish a short assurance statement confirming that these checks have been carried out.
That would be a much more meaningful reassurance than simply saying that their computer systems are secure.
The wider issue: our food supply is becoming increasingly digital
There is a bigger lesson here.
Supermarkets have invested heavily in automation, digital shelf labels, electronic stock control, online ordering, warehouse robotics and energy-management systems.
These developments can reduce costs and improve efficiency. But every additional connected device potentially creates another point of vulnerability.
Consider what could happen if a coordinated attack affected refrigeration at several major supermarket distribution centres rather than individual shops.
Even if alternative stocks were available, disruption to chilled and frozen food distribution could quickly become a serious logistical problem.
And supermarkets are not the only concern. Food manufacturers, meat processors, wholesalers, cold-storage warehouses and transport refrigeration systems are all part of the same supply chain.
The UK cannot assume that because the first major incidents happened in France, the problem stops at the Channel.
The most revealing finding is not that French supermarkets were hacked. It is that British cybersecurity researchers subsequently identified more than 800 potentially exposed refrigeration and building-management controllers in Britain.
That does not mean 800 supermarkets have been compromised, or even that all 800 devices are vulnerable. But it demonstrates that the weaknesses are not confined to France.
There is a question of corporate responsibility here. Supermarkets have a duty to protect customers, their food supplies and their businesses. Cybersecurity should not stop at protecting payment cards and customer information. It must extend to the physical equipment keeping food safe.
A freezer is no longer just a freezer. It is a computer controlling something essential to the food supply.
And perhaps it is time that Britain's supermarket boards started treating it that way.