UK food suppliers hit by European supermarket freezer cyberattacks

Food suppliers across the UK have been targeted in a series of cyberattacks that disrupted refrigeration systems across Europe last month, although domestic disruption remains minimal.

The incidents follow widespread disruption across retailers in Belgium, Estonia, Finland, France, Ireland, Luxembourg, the Netherlands, and Sweden, where hackers compromised commercial refrigeration units, causing temperatures to rise significantly. In the UK, the British Association of Independent Meat Suppliers confirmed that several members experienced defrosting or extreme temperature spikes, although affected units were empty and no stock was lost. One London wholesaler, Langridge Organic, was able to thwart an attack by disconnecting its Copeland refrigeration controllers from the internet after hackers attempted to run defrost cycles at 150C. At the time of writing, no UK supermarket chains have reported direct compromises.

The National Cyber Security Centre (NCSC) confirmed it is assisting affected businesses to remediate vulnerabilities. Speaking at the launch of its tenth annual review, NCSC Director of Operations Paul Chichester noted that the attacks were not enabled by artificial intelligence (AI), but instead exploited long-standing vulnerabilities in legacy internet-connected devices. 

Cybersecurity researchers analysing the activity reported tactical hallmarks aligned with operations linked to Russia. An investigation into decoy systems simulating Danfoss refrigeration controllers revealed over 250 intrusion attempts from 91 distinct sources. 

Training Announcement: The BCS Foundation Certificate in Information Security Management Principles (CISMP) is an entry-level programme aligned with ISO/IEC 27001 and Cyber Essentials that examines the fundamental concepts, technologies and principles of information security management. It provides attendees with practical knowledge of key concepts and techniques in risk management, security operations, and technical, physical, and environmental security. In addition, CISMP addresses legal and regulatory requirements, business continuity and disaster recovery planning, and emerging technologies. Find out more.