IN Brief:
- Refrigeration attacks across Europe have disrupted chilled and frozen food operations, with UK meat suppliers reporting interference.
- Food businesses must assess actual temperature exposure, affected batches, and monitoring evidence before releasing held stock.
- Recovery requires coordinated engineering, quality assurance, and traceability decisions after the refrigeration system is restored.
Restoring refrigeration equipment after a cyberattack may take less time than establishing whether the food stored or processed during the disruption remains suitable for use. As European retailers and British meat suppliers investigate interference with refrigeration controls, food businesses face decisions about product safety, temperature evidence, and the conditions required before affected stock can be released.
Refrigeration systems at supermarkets in several European countries were disrupted on 2 November, following similar incidents in France during October. Some operators reported controllers set to unusually high temperatures or forced into defrost cycles, prompting the precautionary removal or disposal of chilled and frozen goods. In the UK, meat suppliers using Dixell XWEB systems reported altered settings, including one installation programmed to defrost hourly.
The Association of Independent Meat Suppliers urged members to inspect their equipment, although the extent of any resulting losses among British processors has not been established. A manipulated controller setting does not, on its own, establish that stored products reached that temperature, or that the full contents of an affected store must be discarded.
Patrick Lamplmair, CTO and co-founder of Tributech, said the physical impact makes refrigeration an attractive target for disruption.
“There is no data to steal and no ransom to negotiate. A few commands to a temperature controller destroys stock overnight and closes stores.”
For processors holding raw ingredients, work in progress, and finished products in separate temperature-controlled areas, a single equipment incident can affect several stages of production. Recovered machinery may be available before quality assurance teams have established which batches were present, whether acceptable conditions were maintained, and what should happen to materials already moved into production or dispatch.
Establishing which products can be released
The relevant evidence begins with actual conditions rather than the instruction sent to a controller. Refrigerated air can warm before product temperatures change appreciably, depending on the mass of the goods, their packaging, their position within the store, and the length of the interruption. Different foods may therefore require different assessments even when they occupied the same room.
Food businesses operating under hazard analysis and critical control point (HACCP) procedures must apply appropriate corrective actions when monitoring shows that a critical limit has been breached at a critical control point. The Food Standards Agency’s guidance covers restoring control, identifying and controlling affected products, investigating the cause, and documenting the response.
Reconstructing a refrigerated batch’s history may require comparison of air and product temperature readings, alarm logs, warehouse movements, production records, and dispatch times. Where the compromised controller also supplies the principal temperature record, operators need to consider whether independent measurements or retained data can corroborate its history. There is no confirmed evidence that attackers falsified monitoring records during the recent incidents.
Martin Riley, CTO at UK critical infrastructure cybersecurity specialist Bridewell, stressed that removing potentially affected products is an essential part of food safety protection.
“Where monitoring works, affected stock is removed before it reaches anyone. Pulling food off the shelves is the safety system working, not failing.”
Quarantine does not automatically mean disposal. Product type, measured exposure, established limits, and the quality of available records determine whether goods can be released, require further assessment, or must be rejected. Where stock has already moved between processing areas or left the site, batch traceability becomes necessary to identify which products and customers may be affected.
Restoring production after the interruption
Returning a controller to its approved settings addresses only part of the recovery. Engineers must establish that refrigeration is operating reliably and that unauthorised access has been closed, while production planners assess whether approved ingredients remain available and quality teams decide when held products can re-enter the manufacturing process.
Cold storage capacity can itself become a constraint if quarantined goods occupy space needed for incoming materials or subsequent production batches. Delayed release decisions can interrupt packing and dispatch even after equipment temperatures have returned to normal, with consequences for customers expecting time-sensitive deliveries.
Riley described the effects extending beyond the premises where the equipment was compromised.
“The manufacturer loses product and orders. Farmers and growers see stock written off further down the line. The refrigeration contractor carries the reputational damage and often the remediation bill.”
Limiting recurrence requires the engineering investigation to establish how the unwanted operating instructions were introduced. Remote maintenance access, controller configuration, and outstanding software vulnerabilities may all need attention before equipment can be trusted again. Lamplmair advocates verification of individual instructions at the equipment level, including checks that they originate from an authorised source and remain within permitted process conditions.
“A freezer should never accept an instruction to heat to 50°C, no matter who sends it.”
Those checks must accommodate legitimate defrost, cleaning, and maintenance cycles rather than treating every departure from normal storage settings as malicious. Independent alarms and temperature monitoring can provide a further means of detecting abnormal behaviour before product conditions deteriorate, particularly where the controller and its monitoring interface share common infrastructure.
Recovery records should ultimately connect the engineering findings to the decisions made about food. A manufacturer needs a defensible account of when control was lost, which products were affected, the measurements used to assess them, and the actions taken before dispatch resumed. Restoring the refrigeration system is an equipment milestone; releasing the food is a separate, evidence-led decision.
