Businesses in the UK’s food supply chain have been caught by the cyber-attack that drove supermarket fridges and freezers across Europe up in temperature on Monday. The National Cyber Security Centre (NCSC) says it is aware of “a couple of instances where vulnerable technology had been exploited in the UK”.
NCSC chief executive Dr Richard Horne told BBC Radio 4’s Today programme that the centre had “worked through the night” to warn organisations that might be affected.
What happened to British suppliers
The British Association of Independent Meat Suppliers (AIMS), which has more than 300 members, told the BBC that some of them had become what it called “collateral”.
Two members saw their fridges begin to defrost. A third found a cold unit that had been driven up to 100C — boiling point, in a cabinet designed to hold meat below freezing.
AIMS spokesman Tony Goodger said the affected devices happened to be empty, so no produce was lost. He added that the incident “must act as a reminder to all in the food industry at whatever point in the supply chain they are that their businesses may be seen by some as targets”.
The same method, a second time
On Monday, supermarkets in Ireland, Sweden, Estonia, Belgium, the Netherlands and Finland reported units being warmed. Around 40 Delhaize stores in Belgium and Luxembourg were affected, with smaller numbers elsewhere.
Sabcobel, a Belgian company that manufactures some of the affected refrigerators, said the units’ evaporators had been switched into defrost mode. That is the same technique thought to have been used against hundreds of French supermarkets in early October, an attack that spoiled fresh and frozen food estimated in the millions of euros.
Those earlier attacks exploited weaknesses in systems used to control and manage refrigeration remotely — weaknesses that security researchers had publicised months beforehand.
Many retailers hit on Monday again had no choice but to throw food away, in some cases amounting to hundreds of thousands of euros. Mathieu Tilman, who runs a Delhaize supermarket in Belgium, called it “truly distressing”: “There’s so many people starving, people who don’t have enough to eat. How can we end up throwing away so much food?”
What the UK’s cyber chief actually said
Horne said on Tuesday it was “too early to say” who was behind the attacks. His more pointed remarks were about the state of the equipment rather than the identity of the attacker.
“That technology base we rely on as a society has not been invested on to the extent it needs to be,” he said, noting that many organisations run systems past their end of life, fail to upgrade them, and leave them connected to the internet rather than in isolated compartments.
He added that such weaknesses can now be found and exploited faster with “AI in the hands of our adversaries”, and put the responsibility plainly: “We intervene where we can. But, at the end of the day, it’s your business. It’s your charity. It’s your life. You need to make the choice and choose wisely.”
Why a fridge is a computer
The reason this keeps working is that commercial refrigeration stopped being a mechanical trade some years ago. Cold units are managed remotely so that a chain can monitor hundreds of sites centrally, which is sensible, and it means every one of them is an internet-connected controller running software somebody has to patch.
Almost nobody budgets for a freezer the way they budget for a server. That is the gap being exploited, and it is not confined to supermarkets.
Where it stands
There have been few signs of serious impact in the UK so far. Paul Chichester, NCSC director of operations, said at the launch of the centre’s annual report that “at the moment, the impact is minimal”.
The British Retail Consortium said retailers were working with the NCSC on securing refrigeration. Graham Wynn, its assistant director of regulatory affairs, said members “invest heavily in their cybersecurity”; Asda, Lidl, M&S, Sainsbury’s and Tesco are among them.
