British food companies were among those caught up in a major cyberattack that targeted supermarket refrigeration systems across Europe, according to the country’s leading cyber-security official.
Suspected cybercriminals have targeted businesses in at least seven European nations, allegedly raising freezer temperatures to as high as 55C (131F) and destroying large quantities of meat and other food.
Dr Richard Horne, director of the National Cyber Security Centre (NCSC), part of GCHQ, said hackers had taken advantage of weaknesses in technology used by UK organisations.
Security sources told Our News Outlet that only a limited number of British companies were affected.
Asked about the impact in the UK, Dr Horne said: ‘We don’t know the full impact, but we can see there are a couple of instances where vulnerable technology has been exploited, and we will be working with those organisations to understand more.’
He said it remained ‘too early for us to say’ who was responsible and that authorities could not yet provide a ‘definitive answer’ on the perpetrators.
The attack has reportedly hit dozens of stores in Belgium, Sweden, Ireland, Luxembourg and Estonia. It follows a separate incident in France, where hackers manipulated refrigeration units at hundreds of grocery stores just weeks ago.
In the latest incident, the targeted freezers were made by Belgian manufacturer Sabcobel. The company said attackers had placed the units’ evaporators into defrost mode, with temperatures rising from -27C to 50C in some cases.
Dr Richard Horne, director of the National Cyber Security Centre, said UK companies had been caught up in the European supermarket freezer attack
Staff at an ICA supermarket in Sweden were forced to discard bags of food spoiled by the refrigeration failure
The technique resembles last month’s cyberattack on French supermarkets, which resulted in food worth millions of euros being discarded and sparked several small fires.
The French incident involved refrigeration equipment supplied by Danfoss, a company that also works with British retailers such as Tesco and Sainsbury’s.
About 40 Delhaize and Colruyt stores in Belgium and Luxembourg were affected, as were 15 Carrefour outlets.
Tony Goodger, from the Association of Independent Meat Suppliers, said several of the organisation’s 300 members had ‘unexpectedly become collateral’ in the wider European incident.
Speaking to BBC Radio 4’s Today programme, Dr Horne said: ‘It’s not just supermarkets, it’s through the whole food supply chain, and we’ve been working through the night alerting organisations where we can see they’ve got exposed technology that’s vulnerable in this way.
‘So there are handfuls of organisations in the UK we’ve alerted and we’re aware of a couple of impacts.’
An NCSC official told Our News Outlet: ‘We are aware of a small number of UK organisations that may be affected by this incident as a result of vulnerabilities on their systems, and the NCSC is supporting those that may be impacted.
‘We continue to liaise with our international partners and the affected sectors to understand and mitigate its impact.’
The disclosure came as Dr Horne warned in a speech on Tuesday that Britain had reached a point of ‘enormous consequence’ for national cyber-security.
A worker cleans refrigeration units targeted in the cyberattack at an ICA store in Stockholm, Sweden
He said the UK had spent decades getting by with ‘tech on the cheap’. The NCSC’s latest annual report warns that Britain could face a surge of AI-assisted attacks against critical national infrastructure within the next two years.
The report found it was ‘highly likely’ that ransomware groups would use artificial intelligence to target the UK by 2028. It also warned that hostile states, including Russia and China, were expected to use AI routinely to advance their strategic aims.
Launching the report on Tuesday, Dr Horne said: ‘It is clear that our nation is living through a moment that, in hindsight, we will see as one of enormous consequence.
‘A “sliding doors” moment. A moment of choice. In the coming months, we face a real prospect of an unprecedented rise in the number of cyber-incidents.
‘But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.’
His warning came days after Defence Secretary Wes Streeting said Britain needed to be prepared for war within the next 1,000 days.
The Government has also launched a new national resilience campaign encouraging households to keep enough food and water to last for three days.
Dr Horne said: ‘For decades, we have collectively got away with doing tech on the cheap.
‘End-of-life systems kept running for just one more year, well-needed upgrades pushed back as a “cost efficiency”, and technology providers failing to invest in security by design and default.’
According to the NCSC’s annual report, its incident management team received 1,831 reports of cyberattacks during the year. Of those, 337 required direct support and 80 were classified as nationally significant.
The team also warned 8,500 organisations after discovering that their systems had been compromised by attackers, the report said.
