Joshua Wong Gets 10 Years; Hackers Cook Supermarket Fridges

Sam A Hong Kong court has handed down a prison sentence to one of the best-known pro-democracy activists in the world, and the number is a long one. It's a story about a law that has now reached the same man twice. Maya, what happened in court on Thursday, and who is the man at the centre of it?

Maya Joshua Wong, who is 30, was sentenced on Thursday, November 5, 2026, by Hong Kong's High Court to 10 years in prison. The charge was conspiracy to collude with foreign forces, under the Beijing-imposed national security law. He pleaded guilty in September. It is his second conviction under that law, and the Guardian and NPR both described him as the only activist in Hong Kong prosecuted twice under it.

Sam Ten years is a round number, but I'd guess a judge doesn't just pick it. I'm wondering how the court got there, and whether the guilty plea changed anything for him.

Maya Judge William Tam set a starting point of 13 years, then took off three years for the guilty plea and mitigation, which left 10. RTHK reported that 10 years is the statutory minimum for an offence the court classed as grave under Article 29 of the law, and that article carries a maximum of life. Tam said the punishment must fit the gravity of the crime.

Sam He's already in prison, so I can't tell whether these ten years start from zero or get stacked on top of what he's serving.

Maya Mostly on top. Only two months and two days of the new term run concurrently, meaning at the same time, with the sentence he is already serving. That earlier term is four years and eight months for conspiracy to commit subversion, imposed in November 2024 over an unofficial opposition primary. He had been due out on January 7, 2027. AFP reports he is now not due out until late 2036.

Sam So the release date jumps by almost a decade. What exactly is he accused of doing, though? Collusion is a broad word, and I'd like to know what the prosecution says he actually did.

Maya Prosecutors said that between July and late November 2020, Wong conspired with self-exiled former legislator Nathan Law and others to ask foreign governments or organisations to impose sanctions, blockades or other hostile measures on Hong Kong and China. The court called Wong and Law, in AFP's rendering, "two ring-leaders or masterminds." Tam rejected the argument that Wong's role was limited.

Sam Wong was in Hong Kong, and Law was abroad. I'd like to know how the court tied Wong to what Law was calling for, and what evidence was put forward of his links with the United States.

Maya Tam said Wong had gone to the United States seeking foreign interference before the law took effect, then kept amplifying Law's calls for sanctions from inside Hong Kong. The Guardian reported the judge describing that as "underground support." On the evidence, NPR reported that the prosecution pointed to meetings with US politicians including Nancy Pelosi and Marco Rubio in 2016 and 2019, and to lobbying for what became the Hong Kong Human Rights and Democracy Act.

Sam I picture a courtroom with a lot of tension in it. What did it look like when the sentence was read out, and who was there to hear it?

Maya NPR and AFP reported that Wong wore a blue shirt and black-rimmed glasses, nodded to supporters and left calm. Dozens of people waited outside amid a heavy police presence, and the Guardian said international diplomats were in court. Tiffany Chin, a former member of the student group Scholarism, which Wong once led, was in tears. Some supporters were heard saying they would wait for his release.

Sam Wong has been in prison for years already, so I'm curious about what he's actually said since the conviction. Has anything of his own come out, a statement or a letter, that shows how he took the news of a second case?

Maya Yes, a few things. AFP saw a mitigation letter, meaning a letter sent to the judge asking for a lighter sentence. In it Wong wrote that he had hoped to leave in 2027, that the new charge put him back at the beginning, and that the years inside had taught him the "most profound lessons" of his life. His lawyer, Derek Chan, asked for a sentence that left him some hope, and said Wong wants to care for his parents after release, NPR reported.

Sam A letter to a judge is written with a purpose, so I'd expect it to sound a certain way. Were there other letters, ones not aimed at the court, that show what his days look like?

Maya The Guardian said it saw letters written between August and October from Stanley Prison. In them he wrote, "The only thing I worry about is that people will forget Hong Kong." They also describe him studying company law, teaching English and learning guitar. He has no direct internet, so he asks friends to put questions to chatbots for him. That portrait is the Guardian's, from documents it says it reviewed. It is not a court finding.

Sam Asking a friend to query a chatbot for him is a oddly modern detail for a prison story. I also realise that I only half remember how he became famous in the first place, so where does his story start?

Maya With the 2014 Umbrella Movement, when he was a teenager and became its face. Time put him on a cover that October under the line "The Face of Protest," the Guardian noted. From 2017 he was in and out of jail, AFP reported, including over 2014 protest offences. He was released during the 2019 extradition-bill protests, then detained again in November 2020.

Sam So he was already locked up again by the end of 2020, which is the same year the court says he was conspiring with Nathan Law. I'd like to know where the national security law fits into that timeline.

Maya Beijing imposed it on June 30, 2020, after months of sometimes violent demonstrations. Wong was then one of 45 opposition figures jailed in the mass primary case, according to Amnesty. As for how widely the law has been used, the Guardian cites Hong Kong's security bureau for more than 400 arrests under national security legislation. Amnesty separately counts more than 300 arrests under the security law or a colonial-era sedition law. Those are different tallies from different bodies, so there is no single confirmed total.

Sam Putting the pieces together, the second conviction landed just months before his January 2027 release date. Why is that timing getting so much attention, and what do the two sides make of it?

Maya Supporters read that as a warning that prominent dissenters can be kept inside indefinitely by serial charges. Officials read the same facts as proof the law works, and say that calling for foreign sanctions is not peaceful politics.

Sam Moving to the second story, the one about fridges. I only know the headline, which says hackers cooked supermarket fridges. How does somebody cook a fridge from a distance, and where did it start?

Maya It started in mid-October in France. The Guardian reported that hackers seized cooling units at as many as 700 supermarkets in one night. The controllers were exposed to the internet, and the attackers ran defrost cycles until units reached as high as 50°C, which is 122°F. No malware was needed, only a controller facing the public internet with a weak login.

Sam If nobody had to break in with clever code, I'm curious whether it stayed in France or whether the same trick turned up elsewhere.

Maya It spread. Reuters, on November 3, called Monday's wave identical to the French attack about three weeks earlier. The Financial Times counted incidents at almost 100 stores across Sweden, Finland, Ireland, Belgium, Luxembourg and Estonia. The Guardian named Carrefour, Intermarché and Ikea in Belgium, Coop and ICA in Sweden, Delhaize in Luxembourg, Kesko in Finland and SuperValu in Ireland.

Sam Carrefour and Ikea in the same list is a surprise to me. I'd also like to know whether the temperature the machines were told to reach is settled, because a fridge at 50 degrees and one at 55 are different stories.

Maya The sources differ. The Guardian and several retailers say 50°C. The Financial Times reported setpoints as high as 55°C. A setpoint is simply the target temperature the controller is told to hold. Either way it was far above a safe chill, and stores threw out meat, fish and frozen stock. The Guardian's November 4 piece added Italy, Germany and Romania as Tuesday targets.

Sam Britain is the country I'd care about most as a listener here. Did the big British supermarkets get hit as well, and what have the authorities there said?

Maya No major UK chain has been confirmed as directly hit, according to the Guardian and Retail Gazette. The National Cyber Security Centre said it knew of "a couple" of cases in the food supply chain and that national impact was minimal. Its chief executive, Richard Horne, told BBC Radio 4 on November 3 that staff had "worked through the night" alerting organisations with exposed kit.

Sam A couple of cases sounds small, but a small business has no security team to catch this. I'd like one worked example of how a shop discovered it was being cooked, and what it did.

Maya London wholesaler Langridge Organic told The Grocer that six of its 10 cold-room controllers were switched into defrost, with a maximum setpoint of 150°F, and that the automated alarms had been switched off. Staff caught it on manual checks. Managing director Alex Pearce said it looked like "kids put in front of a mixing desk."

Sam That person doing rounds is a reassuring detail. I keep wondering about the money, though, because I've seen a figure of hundreds of millions of euros attached to this. Is that what the fridge hacks cost?

Maya No, and the two get mixed up. Ahold Delhaize said on November 4 that a separate October incident, systems taken offline after an attack on online ordering and supply chains, should cut fourth-quarter net sales by €200 million to €250 million. Operating income would fall by €75 million to €100 million. Those are company estimates, not booked losses and not a ransom. NRC reported the fridge hack hit about 40 of its more than 800 Delhaize stores, and an executive called that damage not material.

Sam Good to have that straightened out. The obvious question is who is behind it, and whether anyone has been named.

Maya No agency has attributed it. EU spokesperson Thomas Regnier said on November 3, "These are not isolated incidents," and declined to name a culprit. The Guardian noted that no ransomware note has surfaced. Rafe Pilling of Sophos said the two plausible readings were state signalling or a lone actor. Pro-Russian brands NoName057(16) and Z-Pentest posted claims, but SentinelOne's November 4 assessment called them unverified, and a researcher told the BBC he was "not convinced."

Sam I'd like the single takeaway from the whole episode, if there is one. What should a listener keep from each of the two stories?

Maya On Joshua Wong, keep the date: he was sentenced on November 5 to 10 years, the statutory minimum for an offence the court called grave, and it stacks almost entirely on top of his existing term. On the fridges, keep that the method needs no malware, only controllers on the public internet, and that Danfoss has told customers to get off public IP addresses and update firmware.

Sam That's all from us on Keeping up. The next episode arrives tomorrow. A note on how this show is made: it's AI-generated, the voices are synthetic, and the facts come from the reporting named in a moment, whose authors are not affiliated with us. Thanks for listening, Maya.

Maya Thank you, Sam, and thank you to everyone listening; I hope the next episode finds you well and that you come back tomorrow to catch up on whatever the world has done in between.

Sam Everything today came from reporting by the Guardian, NPR, AFP, RTHK, Amnesty, Reuters, the Financial Times, the BBC, Retail Gazette, The Grocer, NRC, DutchNews, the Brussels Times, CBS, Ars Technica and SentinelOne.