You’re not a target, you’re collateral: what this month’s cyber attacks mean for your business

If you’ve caught the news this month, you’ll have seen supermarket freezers switched to 50°C, SuperValu stores pulling frozen food from their shelves, and websites...

Emily

Published Date: 06/11/2026

If you’ve caught the news this month, you’ll have seen supermarket freezers switched to 50°C, SuperValu stores pulling frozen food from their shelves, and websites around the world going offline after a major security flaw. It’s easy to think these are problems for big organisations. They aren’t.

The businesses caught up in this month’s attacks mostly weren’t chosen. They were collateral. Hackers didn’t go looking for a particular supermarket or a particular meat supplier. They went looking for a particular weakness, and hit everyone who had it. In the UK, small meat suppliers using the same refrigeration software as European supermarkets were hit, even though nobody was aiming at them.

That’s the real lesson for small businesses in Scotland, Northern Ireland and Ireland. You don’t need to be important to be hacked. You just need to be running the same old equipment or software as everyone else who got hit. In this article, we explain what happened this month, why it matters to your business, and the simple checks that keep you out of the firing line.

At a glance

This month’s attacks: Hackers took control of refrigeration systems in at least 11 European countries, including Ireland and the UK, and critical PHP2Shell flaws put websites worldwide at risk.
The pattern: Attackers scan for weaknesses at huge scale and hit anyone who has them, regardless of size or sector.
The warning: The UK’s National Cyber Security Centre says businesses face a real prospect of an unprecedented rise in cyber incidents in the coming months.
The fix: Know what technology you rely on, and stop running old, unsupported equipment for “just one more year”.

What happened this month?

Supermarket fridges and freezers hacked across Europe

Overnight from Sunday 1 to Monday 2 November 2026, hackers remotely took control of refrigeration systems in supermarkets across Europe, raising temperatures and spoiling tonnes of food. At least 11 countries were affected, including Ireland and the UK. In Sweden, one store’s freezers were switched to 50°C in the middle of the night.

In Ireland, 13 SuperValu stores removed chilled and frozen products from sale, including stores in Lucan, Blanchardstown and Ranelagh in Dublin. Their monitoring systems flagged the problem quickly, and stores were back to normal later that day.

In the UK, the attacks reached small meat processing firms. The Association of Independent Meat Suppliers said a few of its roughly 300 members were affected, with fridges heating up overnight. Luckily, the units were empty at the time. Its spokesperson said the members using the same software as the affected supermarkets had “unexpectedly become collateral”. The attack on French supermarkets in October was reported to have involved old equipment connected to the internet with default passwords.

PHP2Shell puts websites worldwide at risk

In late October, two critical flaws were found in PHP, the software behind most business websites, online shops and booking systems. Websites across the UK, Ireland and Europe were taken offline as a precaution, and security researchers soon reported the flaws being actively exploited. Attackers weren’t targeting particular businesses. They were scanning the internet for any website that hadn’t been updated.

The NCSC’s warning

On 3 November, the UK’s National Cyber Security Centre published its annual review. Its chief executive, Dr Richard Horne, warned that “in the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents”. He was clear that this isn’t because of clever new attacks, but because old weaknesses can now be found and exploited at a scale that was once unimaginable. His message to organisations of every size was direct: “It’s your business… You need to make the choice and choose wisely.”

Why do small businesses become collateral?

Small businesses become collateral because modern attacks are aimed at weaknesses, not at businesses. Hackers use automated tools to scan the internet for any device or system with a known flaw, then attack every match they find. They don’t check who owns it or how big the business is first.

Think of it like a burglar walking down a street trying every door handle. They’re not interested in which house it is. They’re looking for the door that’s been left unlocked. This month, the unlocked doors were refrigeration controllers running old software with default passwords, and websites running out-of-date versions of PHP.

That changes how every business owner should think about risk:

“We’re too small to be a target” no longer holds. The small meat suppliers hit this month weren’t targets either. They just had the same equipment as the businesses that were.
Your risk depends on what you run, not who you are. If you use the same router, phone system, software or equipment as thousands of other businesses, you share their weaknesses.
Speed matters. Once a weakness becomes public, attackers can find every business that has it within hours, so leaving updates for later is far riskier than it used to be.
Small businesses feel it harder. Big retailers have teams monitoring their systems around the clock. A small business might not notice a problem until staff arrive the next morning.

The “one more year” problem

The NCSC put its finger on why so many businesses are exposed. Dr Horne said that for decades, organisations have “got away with doing tech on the cheap”, with “end-of-life systems kept running for just one more year” and upgrades pushed back to save money.

Most small businesses will recognise that. If something still works, it’s natural to keep it. But equipment that no longer receives security updates can’t be fixed when a new weakness is found, and that’s exactly the kind of weakness this month’s attackers went looking for. Here’s the ageing technology we most often find in small businesses:

Technology	Why it’s a risk	What to do
Old routers	Often run outdated software and default passwords, and are the front door to your whole network	Update it, or replace it if the manufacturer no longer supports it
PCs still on Windows 10	Microsoft stopped free security updates for Windows 10 in October 2025	Upgrade to Windows 11 or replace older machines
Ageing phone systems on copper lines	Older systems miss security updates, and UK copper landlines are being switched off by January 2027	Move to a modern, supported digital phone system
Out-of-date websites	Old software, such as unpatched PHP, can be found and attacked automatically	Ask your web or hosting provider to confirm everything is updated
Connected equipment	Fridges, CCTV, alarms and card machines are often installed and never updated	List what’s connected and ask suppliers about updates and remote access
A single internet connection	If your broadband goes down, so do your phones, payments and bookings	Add a backup connection so you can keep trading

None of this needs to happen overnight. But the businesses that come through the next few months best will be the ones that know what they’re running and have a plan to replace what’s past its best.

how to protect your business from cyber attacks

Is your business at risk of becoming collateral?

Answer these quick questions. Every “no” or “not sure” is a gap worth closing.

☐ Do you know every device and system connected to your business network, including equipment like CCTV, card machines and fridges?
☐ Has your router been updated in the last year, and is it still supported by the manufacturer?
☐ Have all default passwords been changed on your router and connected equipment?
☐ Are all your computers on a supported operating system, such as Windows 11?
☐ Is your phone system up to date, and do you have a plan for the landline switch-off?
☐ Has your website provider confirmed your site is fully updated?
☐ Would you find out quickly if something went wrong out of hours?
☐ Could you keep trading if your internet connection went down?
☐ Do you know who to call if you think you’ve been hacked?

If you ticked every box, you’re in a good position. If not, you’re in the same position as many of the businesses caught up in this month’s attacks, and the good news is that each of these gaps can be fixed.

How Yellowcom can help

Yellowcom helps businesses across Scotland, Northern Ireland and Ireland replace ageing technology and close the gaps attackers look for. Our local teams in Glasgow, Belfast and Dublin can help you:

Find your weak spots. Our VSCAN vulnerability scanning checks your connection for open ports, unsafe devices and equipment that needs updating. Learn how vulnerability scanning works.
Upgrade your Wi-Fi and network with business-grade equipment and separate networks for staff, guests and devices. Read our business Wi-Fi guide.
Move to a modern phone system ahead of the landline switch-off, with security updates built in.
Keep trading if your connection fails with reliable business broadband and backup connectivity.
Hand over the day-to-day with managed IT and cyber security services, so updates, monitoring and support are taken care of.
Be ready if the worst happens with a clear recovery plan. Read our disaster recovery guide.

Not sure where to start? There’s no cost and no obligation for an initial conversation. Call us on 0333 015 6651 in the UK or 01 263 5299 in Ireland, or get in touch through our website.

Frequently asked questions

Are small businesses really at risk from cyber attacks?

Yes. Many attacks are automated and aimed at weaknesses rather than particular businesses, so any business running vulnerable equipment or software can be hit. In November 2026, small UK meat suppliers were affected by attacks aimed at refrigeration systems simply because they used the same software as European supermarkets.

What did the NCSC warn about in November 2026?

In its annual review, published on 3 November 2026, the UK’s National Cyber Security Centre warned of a real prospect of an unprecedented rise in cyber incidents in the coming months. It said this is mainly because long-tolerated weaknesses in old technology can now be found and exploited at huge scale.

Were businesses in Ireland affected by this month’s attacks?

Yes. On 2 November 2026, refrigeration systems at 13 SuperValu stores in Ireland were affected, including stores in Dublin. Irish businesses were also exposed to the PHP2Shell website flaws, and the National Cyber Security Centre Ireland issued an advisory urging organisations to update.

What is end-of-life technology?

End-of-life technology is equipment or software that the manufacturer no longer supports with security updates, such as Windows 10 since October 2025. It may still work, but any new weakness found in it will never be fixed, which makes it an easy target for automated attacks.

What should I do first?

Start by making a list of the technology your business relies on, from computers and routers to phone systems and connected equipment. Then check which items are out of date or unsupported. A vulnerability scan can help you find the gaps you can’t see.