The UK faces the prospect of AI-boosted attacks on critical national infrastructure within the next two years, according to the National Cyber Security Centre (NCSC), following suspected cyber attacks on supermarket freezers across Europe.
GCHQ has been alerting organisations in the UK that could be at risk after supermarkets across the continent were hit by issues with freezers and fridges. The chief executive of the NCSC, which is part of GCHQ, said there are a couple of instances in the UK where “vulnerable technology has been exploited” after the cyber attacks.
Warnings issued to UK organisations
Asked if there is any evidence that supermarkets in Britain or freezers of the same make or model have been targeted, Dr Richard Horne told BBC Radio 4’s Today programme: “It’s not just supermarkets, it’s through the whole food supply chain, and we’ve been working through the night alerting organisations where we can see they’ve got exposed technology that’s vulnerable in this way.
“So there are handfuls of organisations in the UK we’ve alerted and we’re aware of a couple of impacts.”
Put to him that some freezers in this country have been switched to defrost, he said: “We don’t know the full impact, but we can see there are a couple of instances where vulnerable technology has been exploited, and we will be working with those organisations to understand more.”
Attack source unclear
Speaking about who was behind the attack, he said: “It’s too early for us to say at the moment and give a definitive answer.”
Asked if it reinforces warnings from the Defence Secretary that people in the UK should stockpile, he said: “Absolutely. And we saw criminal attacks last year impact retailers in the UK. We know it can happen, and we’ve seen it across Europe. We see all sorts of impacts of cyber attacks, and because technology underpins everything, and because there is so much vulnerability in the technology we rely on because it’s been underinvested in, we do need all organisations to look at what they rely on, to invest in renewal, and, at the end of the day, we work 24 by seven.
“We alert people. We intervene where we can. But, at the end of the day, it’s your business. It’s your charity. It’s your life. You need to make the choice and choose wisely.”
AI threats by 2028
Dr Horne is set to warn in a speech on Tuesday that Britain is facing a moment of “enormous consequence” for cyber security. The UK has got away with doing “tech on the cheap” for decades, he is expected to say, as the NCSC’s annual report suggests Britain faces the prospect of AI-boosted attacks on critical national infrastructure in the next two years.
Hackers demanding ransom payments are “highly likely” to use AI to target the UK by 2028 and hostile states such as Russia and China will routinely use the technology to pursue their goals by then, the report found.
In a speech launching the report on Tuesday, Dr Horne will say: “It is clear that our nation is living through a moment that, in hindsight, we will see as one of enormous consequence. A ‘sliding doors’ moment. A moment of choice. In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents.
“But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable. And because far too many of our organisations and supply chains rest on weak technology and operational foundations.”
He will warn that if businesses do not take action now, they will have to explain why they did not heed the warning signs amid empty supermarket shelves and power blackouts. If leaders of organisations of every size and type “do not take the responsibility now to make different choices”, he'll say, “then they will one day have to look their investors, shareholders, employees, customers, suppliers, and ultimately, their families and friends in the eye and explain why, despite knowing the consequences, they failed to make the choices required.
“When food isn’t on shelves, lights aren’t on, businesses have gone under, we may have to explain that we saw the warning signs, understood the risks and still didn’t make the right choices.”
Incident reports and warnings
The NCSC annual report said that its incident management team received 1,831 reports this year of cyber attacks, of which 337 required support and 80 were nationally significant. The team also warned 8,500 organisations when their systems had been compromised by attackers, the report added.
Dr Horne will say in his speech: “For decades, we have collectively got away with doing tech on the cheap. End-of-life systems kept running for just one more year, well-needed upgrades pushed back as a ‘cost efficiency’, and technology providers failing to invest in security by design and default.”
He will add: “Now that also carries through to the technology that underpins the automation of physical processes that are vital to modern life. Electricity switching, sluice gates in water facilities, dam operations, manufacturing lines, heating and refrigeration controls.
“Whilst they are not seen as traditional IT, they too are not built on the strong foundations they require. Their resilience and security is even more overlooked in investment decisions.
“Our resulting exposure as a society is huge and increasingly exploited in cyber attacks as we saw in the recent disruption of refrigeration units in supermarkets in France.”
