The National Cyber Security Centre has confirmed that
UK food suppliers have been caught up in cyberattacks targeting refrigeration systems, with hackers remotely manipulating temperatures at food businesses including a British fruit and vegetable wholesaler where six of its ten refrigeration units were compromised
. The incidents form part of a wider wave affecting
at least eleven European countries including Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, Germany, Romania and the UK
.
For Kent SMEs operating in food retail, hospitality, catering or cold storage, these attacks expose a critical blind spot: internet-connected operational technology devices such as refrigeration controllers, HVAC systems and building management platforms represent an expanding attack surface that most businesses have never secured properly.
What Happened in the UK Refrigeration Cyberattacks
Hackers remotely manipulated the temperatures of fridges and freezers at food businesses
, with
some European retailers forced to dispose of chilled and frozen products after hackers remotely increased temperatures
.
In the UK, hackers tried to target small meat-processing firms, but the impact was minimal
, according to NCSC Chief Executive Richard Horne.
The National Cyber Security Centre, part of GCHQ, confirmed it was working with affected UK businesses after identifying cases where vulnerable technology had been exploited
. Speaking about the incidents,
NCSC operations director Paul Chichester said: “We’re aware of those incidents in the UK, and obviously we’re working with the affected organisations”
.
The timing is particularly concerning given the NCSC’s wider warning this week.
Richard Horne described the refrigeration incident as “just the foothills” and warned that “the most serious risk we face in the short term is just a huge rise in the volume of incidents”
. The agency has already warned that AI-powered ransomware attacks are highly likely against UK critical infrastructure by 2028.
Why IoT and Operational Technology Security Matters for Kent SMEs
The refrigeration attacks highlight a category of risk that extends far beyond food businesses. Across Kent, thousands of SMEs now operate internet-connected operational technology (OT) and Internet of Things (IoT) devices that were never designed with cybersecurity in mind:
- Refrigeration and HVAC controllers in restaurants, hotels, retail stores, care homes and food distribution centres
- Building management systems controlling lighting, heating, access control and environmental monitoring
- Security cameras and surveillance systems with network access and default passwords
- Smart meters and energy management platforms monitoring consumption and controlling equipment
- Industrial equipment controllers in manufacturing, warehousing and logistics operations
- Point-of-sale terminals and payment systems with embedded connectivity
Each represents a potential entry point. Once attackers gain access to an IoT device on your network, they can move laterally to access business-critical systems, steal data or deploy ransomware.
What Kent SMEs Must Do About IoT and OT Security Now
1. Identify Every Internet-Connected Device on Your Network
You cannot secure what you do not know exists. Conduct a comprehensive audit of all networked devices including those installed by contractors, facilities management providers and equipment suppliers. Pay particular attention to:
- Building management and environmental control systems
- Refrigeration, freezer and temperature monitoring equipment
- Security cameras, access control panels and alarm systems
- Printers, photocopiers and multifunction devices
- VoIP phones and conferencing equipment
- Any device with an Ethernet port or Wi-Fi connection
2. Segment IoT Devices Onto Separate Networks
IoT and OT devices should never share the same network segment as your business computers, servers or customer data systems. Use VLANs (virtual local area networks) to isolate operational technology onto dedicated subnets with strict firewall rules controlling what can communicate with what.
For example, your refrigeration controller should have no reason to access your accounting system, email server or file shares. Network segmentation limits an attacker’s ability to move from a compromised IoT device to your critical business systems.
3. Change Default Passwords and Disable Unnecessary Services
Most IoT devices ship with well-known default credentials and unnecessary network services enabled. Change every default username and password immediately, using strong unique credentials stored in a password manager. Disable remote management interfaces unless absolutely required, and if remote access is necessary, enforce multi-factor authentication and restrict access by IP address.
4. Apply Firmware Updates and Security Patches
Many businesses never update the firmware on building management systems, HVAC controllers or security cameras after installation. Establish a process to check for and apply manufacturer security updates quarterly at minimum. If equipment is end-of-life and no longer receiving security patches, budget for replacement – an unpatched controller is a liability.
5. Review Third-Party Access and Supplier Contracts
Refrigeration engineers, HVAC contractors, security system installers and facilities management providers often retain remote access to equipment they installed. Review every third-party access arrangement and ensure:
- Access is authenticated and logged
- Contractors use multi-factor authentication where possible
- Access is revoked when contracts end or personnel change
- Suppliers maintain their own cybersecurity standards
The UK Police Watchdog has repeatedly warned about supply chain cyber risk from third-party suppliers, and IoT device access represents a significant exposure.
6. Monitor for Unusual Behaviour and Anomalies
Deploy network monitoring that alerts you to unusual traffic patterns from IoT devices. A refrigeration controller suddenly attempting to connect to external IP addresses or communicate with internal file servers is a strong indicator of compromise. Log management and security information and event management (SIEM) tools can detect this behaviour if properly configured.
7. Include IoT in Your Cyber Essentials Certification Scope
The Cyber Essentials certification framework addresses network security and device configuration controls that apply equally to IoT equipment. With the UK Government now offering a 75% discount on Cyber Essentials certification, there has never been a better time to validate that your security controls extend to every device on your network.
The Broader Context: Volume of Incidents Rising Sharply
NCSC chief executive Dr Richard Horne warned: “In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents”
.
The latest annual NCSC report states that malicious activity costs UK organisations approximately £14.7 billion annually
.
The refrigeration attacks demonstrate that attackers are expanding beyond traditional IT targets.
The European Union warned that the attacks, which have spoiled tonnes of food across the continent, were “not isolated”
. For Kent SMEs, this means threat actors are actively seeking out poorly secured IoT and operational technology as an easier route into organisations than well-defended IT infrastructure.
Combined with record cyberattack volumes and the NCSC’s recent guidance on disruptive cyberattacks, the case for treating IoT security as a boardroom-level risk is now overwhelming.
How Meridian Micro Supports Kent SMEs With IoT and Network Security
At Meridian Micro, we help Kent businesses across retail, hospitality, food distribution, healthcare and professional services identify, segment and secure operational technology and IoT devices that sit outside traditional IT management.
Our network security assessments map every device on your infrastructure, evaluate segmentation and access controls, and provide a prioritised remediation plan. We work with your existing equipment suppliers to ensure security configurations are maintained and firmware updates applied systematically.
For businesses preparing for Cyber Essentials certification, we ensure IoT devices meet the framework’s technical controls for firewall configuration, secure configuration and user access management.
If your Kent SME operates refrigeration equipment, building management systems, security cameras or any other internet-connected operational technology, now is the time to assess your exposure. Contact Meridian Micro today on 01303 883111 to arrange a confidential IoT security review and ensure your operational technology does not become the next entry point for attackers.