British food suppliers have been caught up in a wave of cyberattacks targeting supermarket refrigerators across Europe, prompting warnings that outdated technology is leaving the UK’s food supply chain exposed.
The National Cyber Security Centre (NCSC) confirmed on Tuesday that vulnerable refrigeration technology had been exploited in a small number of incidents in Britain, after hackers remotely manipulated supermarket fridge temperatures across several European countries.
The attacks have forced retailers in Sweden, Belgium, Ireland and elsewhere to throw away large quantities of fresh and frozen food after refrigeration systems were switched into defrost mode.
Richard Horne, chief executive of the NCSC, said the agency had “worked through the night” to warn potentially affected British businesses.
The British Association of Independent Meat Suppliers, which represents more than 300 businesses, confirmed that some members had been affected, although none had lost any inventory.
The incidents follow a similar attack on hundreds of French supermarkets last month, which caused millions of euros in damage after hackers exploited vulnerabilities in remotely managed fridges.
Hundreds of UK systems exposed
Cyber security researchers have identified more than 800 fridge interfaces associated with British retailers that are accessible over the public internet.
While that does not necessarily mean the systems can be hacked, experts warn that outdated software and poorly secured remote access can leave critical equipment vulnerable.
Martin Riley, chief technology officer at cyber security firm Bridewell, said the food industry was particularly exposed because its products were perishable and operations depended on tightly controlled temperatures.
“A supermarket fridge holds no secrets. It holds a temperature. Change that temperature overnight and you destroy the value of everything inside it within hours,” he said. “There is no backup to restore from. The stock is simply gone.”
Riley said his firm’s research had identified more than 6,000 refrigeration management panels from a single manufacturer exposed online worldwide.
He warned that attackers were increasingly targeting operational technology, the systems controlling physical equipment, rather than simply stealing data or locking businesses out of their IT networks.
Fears over food security
The incidents have raised concerns about the wider consequences of cyberattacks on essential infrastructure, particularly as supermarkets increasingly rely on internet-connected equipment and third-party contractors.
“The cyberattacks affecting supermarkets across the UK and Europe show how incidents can quickly extend beyond IT disruption, affecting food supplies, businesses and consumers,” said Charl van der Walt, global head of security research at Orange Cyberdefense.
“As in the French refrigerator case, the perpetrators and their motives remain unclear, as does whether the incidents are connected”.
He added that attacks did not need to be deliberately designed to spread fear to have that effect.
“When attackers remain hidden, technical details are difficult to verify and the public is left uncertain, trust can quickly erode.”
Ed Hayes, data protection partner at law firm TLT, said operational technology had historically been a “cybersecurity blind-spot”, with retailers investing more heavily in protecting payment systems and customer data than refrigeration and logistics equipment.
“Legacy OT systems that were never designed with cyber resilience in mind are frequently still in use, running without basic security controls,” he said.
The latest incidents come after cyberattacks on Marks & Spencer and the Co-op last year disrupted deliveries and left supermarket shelves empty.
The British Retail Consortium said retailers were working with the NCSC to strengthen their defences against similar attacks.
The NCSC has not identified who is responsible for the latest incidents, with Horne saying it remains “too early to say” who was behind them.
Leave a comment