The UK's food supply chain has been impacted by a cyber attack that disrupted supermarket refrigeration systems across Europe on Monday, raising concerns about the vulnerability of connected technologies in the food industry.
UK Businesses Affected
The National Cyber Security Centre (NCSC) has confirmed it is aware of "a couple of instances where vulnerable technology had been exploited in the UK." Dr Richard Horne, the NCSC's chief executive, told BBC Radio Four's Today programme that the agency had "worked through the night" to alert potentially affected organisations.
The British Association of Independent Meat Suppliers (AIMS) reported that some of its more than 300 members were unexpectedly caught up in the attacks as "collateral." According to AIMS, two members saw their fridges begin to defrost, while another had cold units rise to temperatures of up to 100C (212F). Fortunately, the affected devices were empty at the time, so no produce was lost. AIMS spokesman Tony Goodger urged businesses to remain vigilant, stating that the incident "must act as a reminder to all in the food industry at whatever point in the supply chain they are that their businesses may be seen by some as targets."
European Supermarkets Hit
The cyber attack had a wider impact across Europe, with supermarkets in Ireland, Sweden, Estonia, and Belgium reporting fridges and freezers being hiked in temperature. In Belgium and Luxembourg, around 40 Delhaize supermarkets were affected, while a smaller number of shops were hit in Sweden, Ireland, the Netherlands, Estonia, and Finland.
This incident follows a series of attacks targeting supermarkets and food suppliers across France in early October. Hundreds of stores were affected by an overnight hack that spoiled fresh and frozen food worth millions of euros. Those attacks exploited vulnerabilities in systems used to remotely control and manage cold refrigeration units, weaknesses that cyber security researchers had highlighted months earlier.
Sabcobel, a Belgian company that manufactures some of the affected refrigerators, said the units' evaporators were switched to defrost mode, causing them to warm up. The same method is believed to have been used in last month's French incident. Many retailers affected on Monday said they had no choice but to discard spoiled food, with some reporting losses amounting to hundreds of thousands of euros. Mathieu Tilman, who runs a Delhaize supermarket in Belgium, described the situation as "truly distressing," adding: "There's so many people starving, people who don't have enough to eat. How can we end up throwing away so much food? In moments like these, you just feel like quitting your job."
UK Impact Minimal So Far
So far, there have been little to no signs of similar impact in the UK. The BBC has approached major UK supermarkets for comment on what actions they are taking to safeguard against such attacks. Graham Wynn, assistant director of regulatory affairs at the British Retail Consortium, said: "Retailers invest heavily in their cybersecurity and are currently working with the NCSC to ensure their fridges and freezers are secure as possible against potential attacks." Asda, Lidl, M&S, Sainsbury's, and Tesco are among the trade association's members.
Paul Chichester, director of operations at the NCSC, said at the launch of its annual report on Tuesday that the agency continues to work with and monitor UK organisations affected. "At the moment, the impact is minimal," he added. "We're working with organisations identifying existing vulnerabilities in the UK and trying to get those closed before somebody exploits them."
Growing Concern Over Connected Tech
The incident highlights the growing threat posed by insecure connected devices. NCSC chief executive Dr Horne said it was still "too early to say" who was behind the hacks, but stressed the urgent need for organisations to ensure the technology underpinning daily applications is secure and up-to-date. "That technology base we rely on as a society has not been invested on to the extent it needs to be," he said, noting that many firms had extended systems beyond their end of life, failed to upgrade them, or kept them in insecure compartments connected to the internet. Such actions create vulnerabilities that cyber security experts say amount to low-hanging fruit for hackers, and can be easily exploited. Horne warned that these weaknesses could be found and exploited more quickly and easily via "AI in the hands of our adversaries." He urged all organisations to review their dependencies and invest in renewal, adding: "We intervene where we can. But, at the end of the day, it's your business. It's your charity. It's your life. You need to make the choice and choose wisely."
