SECURITY
INTELLIGENCE BRIEF

WEEK 45 | 2–6 NOVEMBER 2026

UK TERRORISM THREAT: SEVERE

Executive summary

The week featured bomb-threat hoaxes affecting European aviation, suspected cyber interference with supermarket refrigeration and food suppliers, and an NCSC warning that AI-enabled attacks on critical infrastructure could emerge within two years. Policing updates highlighted organised mobile-phone retail robbery and serious-violence investigations. Operational emphasis: continuity planning, OT segmentation, threat reporting and staff readiness

Key judgements

• Cyber disruption to physical systems can affect food safety, availability and continuity.

• Bomb threats can cause disruption even when hoaxes; disciplined response and evidence preservation matter.

• Staff safety takes precedence over stock recovery during robbery.

ACCOLADE UK LTD | SECURITY INTELLIGENCE INTERNAL BRIEF • 1

1 | Dashboard & risk picture

Official threat level

SEVERE — an attack is highly likely. This is the official UK assessment, not a rating assigned by this report.

Week’s watchlist

Aviation bomb-threat disruption; suspected cyber incidents affecting refrigeration and food suppliers; AI-enabled cyber risk; organised retail robbery; serious violence

Data caveat

Police.uk crime data are monthly and lagged; ONS crime statistics are annual baselines. Neither is a weekly incident count

Immediate priorities

Review continuity and emergency communications; audit OT remote access; refresh bomb-threat procedures; reinforce safe retail robbery response

ACCOLADE UK LTD | SECURITY INTELLIGENCE INTERNAL BRIEF • 2

2 | Cyber & critical infrastructure

NCSC Annual Review — 3 November

NCSC CEO Richard Horne warned the UK could face AI-powered attacks on critical infrastructure within two years. This is a forward-looking assessment, not confirmation of an attack

Refrigeration incidents — 2–3 November

Reports described a suspected cyber incident affecting supermarket cooling units across seven European countries and subsequent concerns affecting UK food suppliers. Mechanism and attribution remained uncertain; do not infer state sponsorship

OT security actions

Inventory refrigeration/building-management systems; segregate OT from corporate IT; restrict supplier remote access and require MFA; monitor alarms independently; test manual override, safe shutdown and restoration; confirm supplier escalation contacts

ACCOLADE UK LTD | SECURITY INTELLIGENCE INTERNAL BRIEF • 3

3 | Aviation threats & response

Bomb-threat hoaxes — 5–6 November

Reuters reported a wave of bomb hoaxes affecting dozens of flights across Europe, causing diversions and disruption. Reporting did not establish a single confirmed perpetrator or a genuine device on every affected aircraft

Threat handling

Treat each threat under competent-authority procedures; do not dismiss it at first receipt. Preserve original messages, headers, timestamps and recipients; avoid broad forwarding; notify police/airport security and follow instructions

Continuity

Plan for diversions, delayed staff, freight disruption and temporary closure. Confirm customer communications, staff welfare, restricted-area access and alternate logistics

ACCOLADE UK LTD | SECURITY INTELLIGENCE INTERNAL BRIEF • 4

4 | UK policing & crime

Mobile-phone shop robbery sentencing — 6 November

Met Police reported four men sentenced over mobile-phone shop robberies across London. Ringleader Sammie Govera received 13 years and 6 months; the group stole tens of thousands of pounds’ worth of phones

Woolwich shooting — 6 November

Met Police opened a murder investigation after a man died following a shooting. Active at reporting cut-off; motive and connections should not be assumed

Islington investigation

Police sought to trace a man in an attempted-murder investigation. Appeals are operational information, not findings of guilt

Knife-crime campaign — 2 November

Home Office announced ‘No Place for Knives’ activity in hotspots including Westminster, Croydon and Birmingham. Campaign activity alone is not evidence of a crime trend

ACCOLADE UK LTD | SECURITY INTELLIGENCE INTERNAL BRIEF • 5

5 | Operational actions

Retail security

Review stock display, secure storage, staff positioning, panic alarms and safe withdrawal. Staff should not confront robbers beyond training and policy

Cyber / OT

Check internet exposure, default credentials, supplier VPNs and remote access. Verify backups, local alarms and manual controls

Threat protocols

Refresh bomb-threat/suspicious-email procedures, incident logs and escalation contacts; retain evidence and avoid speculation

Continuity exercise

Tabletop loss of refrigeration, telecoms or transport: authority, safe shutdown, alternatives, welfare, customer communications and recovery

Escalation

Credible threats/immediate danger to emergency services; cyber incidents through internal response and appropriate national reporting channels

ACCOLADE UK LTD | SECURITY INTELLIGENCE INTERNAL BRIEF • 6

6 | Sources & methodology

Sources

NCSC Annual Review / 3 Nov (ncsc.gov.uk); Reuters aviation reporting / 5 Nov (reuters.com); Guardian refrigeration / 2 Nov and UK food suppliers / 3 Nov (theguardian.com); Home Office (gov.uk); Met Police (news.met.police.uk); MI5 threat-level page; ONS annual crime bulletin; Police.uk data archive

Method

Reporting window: 2–6 November 2026. Publicly reported developments and official releases. Suspected cyber activity remains suspected; police investigations/appeals are not convictions; forecasts are assessments. Internal situational-awareness brief, not a substitute for local risk assessments or official instructions

ACCOLADE UK LTD | SECURITY INTELLIGENCE INTERNAL BRIEF • 7