Question

To ask the Secretary of State for Digital, Culture, Media and Sport, whether UK commercial fridges were affected by recent cyber attacks; and what standards, security and reporting requirements are in place to protect commercial fridges.

We are aware of a small number of UK organisations that were affected by the recent cyber attacks, although the impact in the UK remains limited. The National Cyber Security Centre (NCSC) alerted other potentially affected organisations in the UK, enabling them to take appropriate protective action, and continues to support organisations affected by the cyber activity. The Government continues to liaise with international partners and affected sectors to understand and mitigate the impact

Some of the affected devices had known vulnerabilities, and the NCSC continues to highlight the wider risks associated with enterprise and operational technology being directly exposed to the internet (Disruptive cyber activity highlights risk from internet-exposed systems and edge devices). Several organisations, including large supermarkets, were already following NCSC guidance not to expose refrigeration devices directly to the internet, reducing their exposure to this activity. Guidance on the secure deployment of operational technology is provided by the NCSC (Operational Technology), alongside clear messaging on the risks of using internet exposed technology that is inadequately protected or running out of date software.

In the budget on 28 October 2026 the Government announced we will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit.