Europe freezer hack now touches UK food supply chain too, cyber chief warns

Businesses in the United Kingdom's food supply chain have been impacted by the cyber-attack that hit supermarket fridges and freezers across Europe on Monday, when the temperature of refrigeration units in several countries was hiked up.

The UK's National Cyber Security Centre (NCSC) says it is aware of "a couple of instances" in the UK where vulnerable technology had been exploited.

The NCSC's chief executive, Dr Richard Horne, told the Today programme on BBC Radio Four that it had "worked through the night" to alert potentially affected organisations in the UK.

The British Association of Independent Meat Suppliers (AIMS) has told the BBC that some of its more than 300 members unexpectedly became what it called "collateral" in the hacks. Tony Goodger, the association's head of communications, said none of those affected had lost any meat, but the incident must act as a reminder that businesses at any point in the food supply chain may be seen as targets. He urged members and the wider industry to be vigilant.

On Monday, supermarkets in countries including Ireland, Sweden, Estonia and Belgium reported fridges being hiked in temperature. Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, while a smaller number of shops were hit in Sweden, Ireland, the Netherlands, Estonia and Finland.

Sabcobel, a Belgian company that manufactures some of the affected refrigerators, said the units' evaporators were switched to defrost mode, causing them to warm up. The same method was thought to have been used in last month's incident in France.

Monday's events followed attacks targeting supermarkets and food suppliers across France in early October. Hundreds of stores were targeted by that overnight hack, which spoiled fresh and frozen food estimated to be worth millions of euros. Those attacks exploited vulnerabilities in systems used to remotely control and manage cold refrigeration units that cyber-security researchers had surfaced months earlier.

As in France, many retailers affected on Monday said they had no choice but to throw away spoiled food, in some cases amounting to hundreds of thousands of euros in lost produce. Mathieu Tilman, who runs a Delhaize supermarket in Belgium, told the BBC he found it "truly distressing": with so many people not having enough to eat, ending up throwing away so much food made him feel, in moments like these, like quitting his job.

Horne told the BBC on Tuesday that it was still "too early to say" who was behind the hacks, but he pointed to an urgent need for organisations and businesses to ensure the technology underpinning a whole range of everyday applications is secure and up to date.

Horne said the technology base society relies on has not been invested in to the extent it needs to be. Many firms had extended systems beyond their end of life, not upgraded them, and not kept them in secure compartments disconnected from the internet. Such vulnerabilities amount to low-hanging fruit for hackers, and can be found and exploited more quickly and easily with AI in the hands of adversaries, he warned. He urged all organisations to look at what they rely on and invest in renewal, noting that in the end the choice belongs to each business itself.

So far there have been little to no signs of any such impact in the UK. Graham Wynn, assistant director of regulatory affairs at the British Retail Consortium, said retailers invest heavily in their cybersecurity and are currently working with the NCSC to keep their fridges and freezers as secure as possible against potential attacks. Asda, Lidl, M&S, Sainsbury's and Tesco are among the trade association's members.