November 9, 2026
in
Cyber Security
News by Paul Chijioke
Cyber attacks don’t have to start with someone clicking a phishing email. Just in the past few days, we’ve seen attackers manipulate connected refrigeration systems across Europe, hundreds of thousands of files from Bristol schools published online, and customer information exposed following a breach at a third-party marketing software provider.
Different organisations. Different technologies. Different attacks.
But there is a common thread: the breach doesn’t necessarily start inside the organisation being affected. For SMEs across the North West, that matters.
"In one week, three disclosures showed the same thing: breaches rarely start where you’d expect. Refrigeration controllers were left unpatched. A shared schools platform exposed 320,000 files. A marketing supplier leaked customer data. None of these needed a phishing click. Each one exploited something connected, trusted and overlooked. For North West SMEs the message is clear: tighten security beyond the edges of your own network, before someone else’s weakness becomes yours."
– Paul Chijioke, Cyber Security Analyst, Apex Computing
What happened?
Hackers targeted inter-connected refrigeration systems
In early November, 9 European countries, followed by an attack against 700 supermarkets in France before the UK, were hit by attacks against their refrigeration systems. Attackers were able to manipulate connected refrigeration controllers, including systems from Danfoss and Copeland, changing operating settings and triggering defrost cycles. Some refrigeration equipment reached temperatures of around 50°C, forcing retailers to dispose of stock. Crucially, Swedish retailer ICA reported that the equipment affected in its stores was connected outside its centrally managed network.
This wasn’t simple somebody “hacking a fridge”. Commercial refrigeration is operational technology (OT). Controllers can be remotely accessible so engineers can monitor temperatures, diagnose faults and change settings. That convenience becomes a risk when equipment is exposed to the internet, inadequately patched or poorly separated from other infrastructure.
Security researchers and authorities have identified vulnerabilities affecting Danfoss and Copeland controller families, including authentication bypass and command=injection flaws, although it hasn’t been confirmed that specific vulnerabilities were used in every incident.
The lesson for SMEs: if a device connects to your network, it needs to be part of your security strategy, whether it looks like “IT” or not.
320,000 Bristol school files were published online
Last week, families across Bristol were told that data stolen from a schools’ IT network had been published online by cyber criminals, with around 320,000 files potentially taken and 39 schools affected. The disclosure followed a cyber attack first identified in September, but it was on 30th October that Bristol City Council learned the stolen information had been published, with parents and carers informed on 3rd November.
The affected environment supported services including scheduling, staff records and payroll, meaning potentially sensitive information was held within a network shared across multiple schools. This is a useful remind that a cyber incident doesn’t end when attackers first gain access. Stolen information can resurface weeks or months later, while shared or fragmented IT environments can mean one compromise affects multiple organisations and large volumes of data.
The lesson for SMEs: your security is influenced by the systems and organisations you depend on, not just the infrastructure you directly control.
Who Gives a Crap: customer data exposed through a third-party provider
At the beginning of November, Who Gives a Crap disclosed that customer information had been exposed following unauthorised access to one of its third-party marketing software providers. The intrusion began on 30th October, was identified on 31st October and secured by 1st November. The exposed information included names, email addresses, phone numbers, postal addresses and customer spending information. The company said payment information and passwords weren’t involved, and UK customers were among those affected.
What makes this particularly relevant for SMEs is that the retailer’s own customer accounts weren’t directly compromised. The exposure happened through technology elsewhere in its software supply chain.
The lesson for SMEs: outsourcing a services doesn’t outsource the risk. Every CRM, marketing platform, HR systems or finance application that holds or connects to your data becomes part of your wider security perimeter.
The SME reality check
It’s easy to read stories like these and assume they concern supermarkets, councils and large international brands. But the underlying risks are just as relevant to a 20, 100 or 300-user business in Manchester, Rochdale or Preston.
Your supply chain is part of your attack surface
Cyber criminals don’t need to attack the biggest company first. A smaller supplier with weaker controls can provide a more attractive route into data, systems or business relationships. If larger customers trust you with data or system access, your cyber security can directly affect theirs, and vice versa.
IoT and shadow IT deserve more attention
Walk around a typical SME and there may be far more network-connected technology than appears on the IT asset list:
- CCTV and security systems
- Smart TVs and meeting-room technology
- Door-access systems
- Environmental and building controls
- Warehouse scanners
- Printers and multifunction devices
- Manufacturing or operational equipment
The question isn’t simply whether those devices are protected by a password. Can one communicate with the same network that contains laptops, servers or business-critical data? If so, a compromise of a forgotten device could become a route towards something much more valuable.
Every SaaS integration creates another relationship to manage
Marketing automation, CRM, HR, payroll, finance and analytics platforms frequently integrate through APIs and application permissions. Those integrations are incredibly useful, but connecting an application to Microsoft 365, a CRM or another business platform can give it access to valuable business information. You therefore inherit an element of that supplier’s security risk.
Cyber resilience is becoming a business advantage
From Manchester and Liverpool to Preston and Carlisle, businesses are becoming more connected to customers, suppliers, cloud platforms and smart technology.
That's good for productivity. But every connection needs an owner, a purpose and an appropriate level of protection.
The lesson from this month's incidents isn't that businesses should disconnect everything. It's that you need to understand what is connected, who can access it and what happens if one part of that chain is compromised.
Organisations that can answer those questions confidently are not simply reducing cyber risk. They're becoming more resilient businesses and more trustworthy partners.
