UK businesses have been affected by the same cyber attack that allowed hackers to overheat supermarket fridges across Europe, the head of the National Cyber Security Centre (NCSC) has revealed.
Richard Horne, chief executive officer of the NCSC, which is part of GCHQ, warned that the threat extended beyond supermarkets to the entire food supply chain.
Overnight alerts issued to UK organisations
Speaking on BBC Radio 4's Today programme, Dr Horne said: "We have been working through the night alerting organisations where we can see they've got exposed technology that is vulnerable in this way."
He added: "There are handfuls of organisations in the UK we've alerted and we're aware of a couple of impacts, we think. We don't know the full impact but can see there are a couple of incidents where vulnerable technology has been exploited and we have been working with those organisations to understand more."
Attack on supermarket chillers
Monday's attack affected dozens of supermarkets across seven countries in Europe. Hackers remotely raised the temperatures of in-store chillers to as high as 55C, leading to millions of euros worth of ruined food. It is the second time in recent weeks that retailers' fridges have been targeted, raising concerns about gaps in their security.
The identity of those responsible remains unknown. Asked who might be behind the attacks, Dr Horne said: "It's too early for us to say. At this stage we just don't know. It might be states, it might be criminals. It is a genuine unknown at this stage. They all have different motivations."
Wider vulnerabilities and AI threat
Dr Horne described the incident as a timely warning of the ever-present threat from cyber attackers, made worse by the rapid development of AI. He said that while the latest incident involved supermarkets, all businesses households rely on could be in danger, right down to the local corner shop.
"The fact is technology underpins everything we rely on in our everyday lives," he said. "It is not just IT but operational technology that controls physical things, like electricity switching, water, and refrigeration units. And that technology base that we rely on as a society has not been invested in the way to the extent it should have been.
"Many organisations have sweated their assets, have extended use of systems beyond their end of life and not kept them upgraded. And that leaves a whole load of vulnerabilities that now AI, in the hands of our adversaries, can enable them to find with ease and exploit."
Dr Horne said "there are vulnerabilities in all sorts of technologies, keeping our lights, keeping our water running, keeping food on the shelves, they all rely on technology to be there, to be operating correctly and on much of that technology there is vulnerability that shouldn't be there and we need all organisations to invest in renewing their technology."
NCSC annual report warns of AI-boosted attacks
He earlier warned that Britain was facing a moment of "enormous consequence" for national cyber security akin to the plot of the film Sliding Doors, as the NCSC's annual report suggested the country was in danger of AI-boosted attacks on critical national infrastructure within the next two years.
The report found that hackers demanding ransom payments are "highly likely" to use AI to target the UK by 2028, and that hostile states such as Russia and China will routinely use the technology to pursue their goals by then.
In a speech launching the report, Dr Horne said: "It is clear that our nation is living through a moment that, in hindsight, we will see as one of enormous consequence. A 'sliding doors' moment. A moment of choice.
"In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."
He went on: "When food isn't on shelves, lights aren't on, businesses have gone under, we may have to explain that we saw the warning signs, understood the risks and still didn't make the right choices."
The NCSC annual report said that this year its incident management team received 1,831 reports of cyber attacks, of which 337 required support and 80 were nationally significant. The team also warned 8,500 organisations when their systems had been compromised by attackers, the report said.
