UK & Europe Cyber Attack Statistics 2026: Retail, Automotive & SCADA
What hit UK and European retailers, manufacturers and industrial control systems in the last 60 days, why those attacks worked, and what security teams should expect before the end of 2026. Every figure below links to its public source; items based on media or vendor reporting are labelled as reported.
Updated 12 November 2026 · Prepared by the Mutex Systems security team
The numbers that matter
1,831
attack reports received by the UK NCSC (Sep 2025 – Aug 2026), up from 1,727
25.2%
of EU ransomware claims hit manufacturing — the most-targeted sector (ENISA)
9,663
ransomware victims named on leak sites in 2026 to 11 November — up 32% year on year
Retail & Consumer Brands
Retail was the most visible target in the UK during the window. Attackers went after e-commerce platforms, customer data and — for the first time at scale in Europe — the operational technology that keeps food safe.
Incidents in and around the window
TFG London (Phase Eight, Hobbs, Whistles) disclosed a cyber incident affecting IT systems; stores stayed open but some website and order-processing functions were disrupted.
ASOS confirmed that an unauthorised party accessed some customer personal information, including names and contact details. H&M said it was investigating claims of an attack.
Refrigeration controllers at up to ~700 French supermarkets were switched to defrost overnight, causing large-scale food spoilage and around twenty fires. The Paris prosecutor has attributed the attack to an IRGC-linked cyber unit and issued arrest warrants.
A second wave hit refrigeration and freezer systems in supermarkets across Belgium, Luxembourg, the Netherlands, Italy, Sweden, Estonia, Ireland, Portugal, Poland, Spain and Germany.
Why these attacks worked
- Internet-exposed building and refrigeration controllers were reachable with default or guessable credentials — an OT problem sitting inside a retail estate.
- Retailers run large third-party ecosystems (e-commerce platforms, payment, logistics, facilities vendors); one weak supplier exposes the brand.
- Customer data and peak-season revenue make retailers attractive for both extortion and disruption.
What to do this month
- Inventory every internet-facing controller (HVAC, refrigeration, CCTV, BMS) and take it off the public internet or behind a VPN with MFA.
- Replace default credentials across store estates and monitor controller logins centrally.
- Run an external attack-surface review and web application penetration test before Black Friday trading.
- Hold a ransomware and customer-data-breach tabletop exercise, including ICO notification within 72 hours.
Automotive & Manufacturing
We found no confirmed European car plant stopped by ransomware in the last 60 days. The risk has not gone away: ransomware against European manufacturers kept climbing through 2026, and the 2025 Jaguar Land Rover shutdown remains the benchmark for what a single incident can cost.
Incidents in and around the window
Jaguar Land Rover production at its three UK plants was largely halted for about five weeks; the economic impact was estimated at about £1.9 billion with roughly 5,000 businesses affected across the supply chain.
Ransomware victims in European manufacturing rose 85.4% in the first seven months of 2026, according to Black Kite.
Manufacturing absorbed 25.2% of ransomware claims across the EU — the largest share of any sector.
Dealer-portal outages and an unverified ransomware data-leak claim against a major Japanese carmaker show attackers probing dealer networks and connected-vehicle back ends rather than only plants.
Why these attacks worked
- Just-in-time production means hours of IT downtime turn into lost vehicles and supplier insolvencies.
- Flat networks between corporate IT and plant-floor OT let ransomware spread to production systems.
- Dealer, finance and connected-car platforms add internet-facing attack surface outside the factory.
What to do this month
- Segment IT from OT (IEC 62443 zones and conduits) and test that the segmentation actually holds.
- Assess Tier-1 and Tier-2 suppliers — ISO 27001, Cyber Essentials Plus or TISAX evidence before connecting them.
- Keep offline, tested backups of MES, PLC programs and engineering workstations.
- Run 24/7 detection on remote-access paths (VPNs, vendor jump hosts) — a common ransomware entry point.
SCADA, OT & Critical Infrastructure
Attacks on industrial control systems moved from proof-of-concept to real-world disruption in Europe this autumn — from supermarket refrigeration to small hydro and water assets — mostly through controllers left reachable from the internet.
Incidents in and around the window
Coordinated manipulation of commercial refrigeration controllers in France and then eleven more EU countries; the FBI urged operators to take such controllers off the public internet.
Reported intrusions into Italian OT assets — including a small hydroelectric plant’s PLC/HMI and an exposed textile line — attributed by researchers to hacktivist activity. Not yet confirmed by an Italian CSIRT advisory.
Joint warning from agencies including CISA, the FBI and the UK National Crime Agency about IRGC-linked actors targeting energy, water and retail control systems; reporting cites a UK energy site shut down in July.
One internet-wide scan counted 88,955 ICS-tagged devices reachable from the public internet — exposure, not attacks, but the root cause of most incidents above.
Why these attacks worked
- Controllers ship with web interfaces and default passwords and are often installed by facilities contractors outside the security team’s view.
- Hacktivist and state-linked groups favour visible, physical disruption, and OT gives them it cheaply.
- Legacy PLCs and HMIs cannot be patched quickly, so exposure persists for years.
What to do this month
- Run an OT asset discovery and external exposure scan (Shodan-class) across every site.
- Apply NCSC CAF / NIS-style controls: remote access only via MFA-protected jump hosts, logging to a SOC.
- Monitor OT networks passively and alert on new connections, logins and set-point changes.
- Rehearse manual-operation fallbacks for critical processes.
What to expect in the coming weeks
A UK surge is expected
The NCSC chief executive has warned of a possible unprecedented rise in incidents in the coming months, and the NCSC expects AI-powered malware to feature in a ransomware attack on UK critical national infrastructure by 2028.
Peak-season retail targeting
Black Friday (27 November 2026) and Christmas trading concentrate revenue and customer data. Combined with the October retail incidents, expect continued phishing, credential-stuffing, web-skimming and extortion against retailers through December.
More OT controller campaigns
The second refrigeration wave on 2 November shows the campaign is repeatable. Any vendor controller with a public web interface and default credentials should be treated as an active target.
Edge devices remain the front door
VPN and remote-access appliances continued to be exploited in October (an actively exploited Ivanti Connect Secure flaw was disclosed on 13 October). Patch windows for edge devices should be measured in days, not months.
Data theft over encryption
ENISA reports that exfiltration appears in about 73% of ransomware cases versus about 14% for encryption — expect extortion without disruption, which makes detection, not just backups, essential.
Regulation is tightening
The UK plans a ban on ransomware payments by public-sector bodies and CNI operators with mandatory incident reporting, alongside the Cyber Security and Resilience Bill and EU NIS2 enforcement.
How Mutex Systems helps
We find the exposure before attackers do, watch it around the clock, and keep the evidence regulators ask for.
- Penetration testing of web, mobile, API, cloud, network and OT-adjacent systems.
- Managed SOC & MDR with 24/7 detection on remote access, endpoints and cloud.
- AI agents for GRC & SOC that triage alerts and keep compliance evidence current.
- Framework programmes — Cyber Essentials, ISO 27001, NIS2, NCSC CAF, PCI DSS and more.
grComply: turn this report into tracked controls
grComply, our GRC platform, maps the actions above to the frameworks you hold — ISO 27001, Cyber Essentials, NIS2, PCI DSS — scans for exposed assets, and keeps evidence and risk owners in one place, so a board can see progress rather than a spreadsheet.
See how grComply worksFrequently asked questions
How many cyber attacks were there in the UK in 2026?
The NCSC received 1,831 attack reports between September 2025 and August 2026 (up from 1,727 the year before). 337 needed hands-on support and 80 were classed as nationally significant. These are incidents reported to the NCSC, not every attack in the UK.
Which UK retailers were hit by cyber attacks in October 2026?
Reported incidents in October 2026 include TFG London (owner of Phase Eight, Hobbs and Whistles), ASOS, which confirmed unauthorised access to some customer data, and H&M, which said it was investigating claims of an attack.
What happened to supermarket fridges in France?
On 11 October 2026 attackers switched refrigeration controllers at up to about 700 French supermarkets into defrost mode, spoiling food and triggering around twenty fires. A second wave on 2 November hit supermarkets in eleven more EU countries. French prosecutors have attributed the attack to an IRGC-linked unit. The controllers were reachable from the internet with weak credentials.
Are car manufacturers in Europe still being targeted?
Yes. Manufacturing took the largest share of EU ransomware claims (25.2%, ENISA) and European manufacturing ransomware victims rose 85.4% in the first seven months of 2026 (Black Kite). We found no confirmed European car plant stopped by ransomware in the last 60 days; the 2025 Jaguar Land Rover shutdown, estimated at about £1.9bn, shows the potential cost.
What cyber attacks are expected in the coming weeks?
Expect continued attacks on retailers around Black Friday and Christmas, further campaigns against internet-exposed OT controllers, exploitation of VPN and edge devices, and data-theft extortion. The NCSC has warned of a possible unprecedented rise in incidents in the coming months.
How can a UK business reduce its risk right now?
Remove internet exposure from controllers and admin panels, enforce MFA on all remote access, patch edge devices within days, test backups offline, run a penetration test on customer-facing systems, and put 24/7 monitoring on critical systems. Cyber Essentials Plus is a practical baseline.
Sources
- NCSC Annual Review 2026 (published 3 Nov 2026)
- ENISA Threat Landscape 2026 (Sep 2026)
- Ransomtracker — ransomware victims by month, 2026
- Black Kite — 2026 European Cyber Risk Report
- CNN — cyberattack on supermarket refrigeration systems in France (14 Oct 2026)
- 2026 French supermarket refrigerator hack (overview and November wave)
- TFG London cyberattack — Phase Eight, Hobbs, Whistles (Oct 2026)
- UK retail cyber attacks explained (ASOS, H&M and others)
- Jaguar Land Rover cyberattack (2025)
- Auto dealership cybersecurity news — October 2026
- Critical infrastructure under siege — from freezers to wider OT
- The National — trail of Iran’s fridge hackers (10 Nov 2026)
- Exposed SCADA systems — internet scan analysis 2026
Check your exposure before peak season
A scoped external attack-surface review and penetration test, with findings mapped to your compliance frameworks. Call 020 3307 5299.