Speaking on BBC Radio 4’s Today show, the National Cyber Security Centre (NCSC)’s chief executive, Dr Richard Horne, shared that the NCSC is “aware of a couple of instances where vulnerable technology had been exploited in the UK”, possibly changing supermarkets’ food cooling settings.
He added that the group “worked through the night” to alert impacted retailers.
This comes after a cyber attack hit supermarket fridges and freezers across Europe on Monday, 2 November.
The malicious hacks also affected Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden. Multiple companies have confirmed that their online systems were hijacked.
As a result, millions of euros worth of food was reportedly “ruined”.
Christophe Hansen, the European Commissioner for Agriculture and Food, said the EU was taking these attempts “very seriously”, adding: “They are a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it — a warning that we must take seriously”.
Swedish shop bosses even reported that “hot air is blowing into the freezers”, destroying temperature-sensitive items.
Wait – how can you hack a fridge?
Most of our fridges at home are unconnected to the internet (though they do rely on the National Grid’s power supply, which some experts worry could be hacked too).
However, because supermarkets have to chill food at such scale and to certain safety standards, their fridges and freezers are typically on a network that can be controlled by central management. That way, bosses can control exact temperatures and other settings in their cooling units.
Not all of those networks are on the internet. But some companies, like European refrigerator supplier Danfoss, say that making this system available via the internet can cut callout costs by as much as 15-30%, because systems can be fixed remotely.
UK Cyber Defence identified 800 cooling systems used by British retailers that could, in theory, be accessed through the internet. That doesn’t mean they’ll definitely be hacked, but it may add vulnerabilities.
Insecure internet connections, password issues, outdated tech, and outsourced technological help could increase these potential risks further.
And according to chief executive of cybersecurity company Dragos, Robert Lee, AI tech like large language models could make these intrusions more possible: “The reach and scale of these attacks is new”.
What do we know about the UK effects so far?
Speaking to the BBC, Tony Goodger, head of communications at the British Association of Independent Meat Suppliers, said that some of its members’ supplies were “collateral” in the hacks.
“None who have been affected have lost any meat, but once again this must act as a reminder to all in the food industry at whatever point in the supply chain they are that their businesses may be [seen] by some as targets… We urge our members and the wider industry to [stay] vigilant.”
And Dr Horne added that while we don’t know the full “impact” of the hacks in the UK yet, “it’s not just supermarkets; it’s through the whole food supply chain, and we’ve been working through the night alerting organisations where we can see they’ve got exposed technology that is vulnerable in this way.
“So there are handfuls of organisations in the UK we’ve alerted, and we’re aware of a couple of impacts we think.”
He even cautioned that power and water suppliers could be similarly affected.
This comes weeks after the government launched its “Be Ready” campaign, which suggests “simple and effective steps you can take to be ready for emergencies and the disruption they cause”.
Defence Secretary Wes Streeting warned at the time that cyber attacks, such as attempts on the PHP vulnerabilities that recently took hundreds of important sites offline, will happen “more and more” often.
