Fridge Cyberattacks Hit UK Meat Suppliers via Copeland XWEB

Executive Summary

Three British meat suppliers were caught in the fridge cyberattacks that spoiled food at supermarkets across Europe in the early hours of 2 November 2026, according to the Association of Independent Meat Suppliers (AIMS). The trade body said its members were reached through Copeland XWEB refrigeration control units. The US Cybersecurity and Infrastructure Security Agency (CISA) warned of serious flaws in the newer XWEB Pro model on 26 February 2026 and said Copeland had already released a fix. Britain’s National Cyber Security Centre (NCSC) called the national impact minimal. Sweden’s NCSC, handling the ICA and Coop incidents from the same night, has named no manufacturer. No group has claimed the attacks.

Fridge Attacks Reach Three UK Meat Processors

AIMS spokesperson Tony Goodger described the three members as collateral damage. Their fridges were empty when the attackers got in, he said. No meat was lost. “Whoever these hackers are, they have targeted European supermarkets who are operating the same software,” Goodger said. AIMS says it alerted the NCSC as soon as members reported problems.

XWEB is the networked unit that sets temperatures for every refrigerated cabinet on a site. A security note circulated to AIMS members, according to a published report, said older XWEB software let attackers take control without a password.

A February Fix for XWEB Pro

That matches the CISA advisory from February. It covers three XWEB Pro models and says Copeland has provided a fix. The most serious flaw lets an attacker run commands on the unit without logging in. When the advisory came out, CISA said no public exploitation had been reported to it.

Researchers at Claroty, who found the flaws, published their analysis on 9 August 2026. They showed that the unit’s daily administrator password can be worked out from details anyone can read off the device. In a lab demonstration the team switched off a fridge’s cooling fans while the display kept showing a normal temperature. Copeland has released an update that fixes the flaws, according to Claroty.

The older XWEB EVO is not covered by that fix. In a product bulletin dated 14 October 2026 Copeland said EVO units have reached end of service and will receive no further security patches. No fix is coming. It told owners to take every EVO off the public internet immediately and then look for suspicious activity.

Britain’s NCSC Calls National Impact Minimal

NCSC staff worked through the night contacting companies whose vulnerable systems the agency had found exposed online. Paul Chichester, its director of operations, called the impact so far “minimal” at the launch of the agency’s annual review on 3 November.

In Sweden, Coop press chief Carlos Cancino put the count at seven stores, six around Gävle and one in Sundsvall. ICA said a limited number of its stores were hit and that they connect outside its central network. Earlier coverage of the ICA and Coop incidents has the first store reports. Sweden’s NCSC, part of the signals intelligence agency FRA, published a notice on the evening of 2 November. The centre said it is in contact with affected businesses and with counterparts in several Nordic and other European countries while it asks organisations to list their internet-connected devices and decide whether each one needs that connection.

Which XWEB Generation Was Hit Is Still Open

The AIMS note points at XWEB Pro firmware for which a fix exists. Copeland’s own October statement described a vulnerability in “a discontinued, end-of-life generation of controllers”. No authority has linked the fridge cyberattacks to a specific flaw.

Copeland hasn’t said which generation the UK members ran.

A Patch Window for Pro, None for EVO

CISA published the XWEB Pro advisory 249 days before the 2 November fridge cyberattacks. For an owner of a Pro unit that had not been updated the remedy had been available since February. EVO owners never had a patch. Copeland’s only remedy for them is disconnection and replacement. Sweden’s NCSC notice covers internet-exposed devices in general and names neither generation.

The CISA advisory, ICSA-26-057-10, covers the XWEB 300D PRO, 500D PRO and 500B PRO on firmware 1.12.1 and earlier. Its most serious flaw, CVE-2026-21718, is an authentication bypass rated 10.0 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) that allows code execution before login. Claroty Team82 found that the daily administrator password is derived from the date, the device’s MAC address and keys hard-coded in the firmware. Copeland fixed all 23 flaws in XWEB Pro firmware 1.13. The older XWEB EVO is end of service and has no fix.

References

1. Copeland XWEB and XWEB Pro, ICSA-26-057-10
2. CVE-2026-21718 Detail
3. Chilling Discoveries: Unpacking Vulnerabilities in Copeland XWEB Pro Controllers
4. Recommandations pour une utilisation sécurisée des superviseurs XWEB
5. Cyberangrepp mot uppkopplade frys- och kylsystem
6. Published report

This post is also available in: