The NCSC has urged supermarkets and other organisations to avoid connecting refrigeration and cooling systems directly to the internet while ensuring strong passwords and regular security updates are in place.
The warning follows recent attacks on cooling installations in multiple European countries, including the Netherlands. In several cases, affected retailers were forced to discard perishable goods or temporarily close stores because temperature control was lost.
According to the NCSC, the incidents highlight the risks posed by poorly secured industrial and IoT devices. "Products can become too warm and spoil, endangering food safety. Installations may also fail, leading to financial damage, product waste and potential business disruption," the agency stated.
Manufacturer Danfoss reported that compromised systems were using default passwords and had not been placed in a protected network segment. The NCSC recommends that cooling systems should never be directly reachable from the internet. Where remote access is essential, it should be restricted to trusted IP addresses only.
Additional measures include the use of strong, unique passwords, timely installation of security patches, regular configuration checks and continuous monitoring for anomalous behaviour. Similar advisories have already been issued by authorities in Belgium, France and Germany after attacks on supermarket refrigeration units in France last month.
