The same cyber attack that allowed hackers to raise supermarket fridge temperatures to 55C and destroy millions of euros worth of food across Europe has affected UK businesses, the National Cyber Security Centre (NCSC) has confirmed.
Richard Horne, chief executive of the NCSC, part of GCHQ, said a number of British organisations had been alerted after vulnerable technology was identified, with some already believed to have been affected.
Warning over vulnerable technology
Speaking on BBC Radio 4's Today programme, Dr Horne said the NCSC had been working through the night to warn organisations whose systems could be exploited by hackers. He said: "We have been working through the night alerting organisations where we can see they've got exposed technology that is vulnerable in this way. There are handfuls of organisations in the UK we've alerted and we're aware of a couple of impacts, we think. We don't know the full impact but can see there are a couple of incidents where vulnerable technology has been exploited and we have been working with those organisations to understand more."
The warning follows a major cyber attack on Monday that affected dozens of supermarkets across seven European countries. Hackers remotely manipulated in-store refrigeration systems, forcing temperatures in some chillers as high as 55C and leaving millions of euros worth of food ruined.
Second attack on refrigeration systems
It is the second time in recent weeks that retailers' refrigeration systems have been targeted, raising fresh concerns about the security of technology used to keep essential supplies running. The identity of those behind the latest attack remains unknown.
Asked who could be responsible, Dr Horne said: "It's too early for us to say. At this stage we just don't know. It might be states, it might be criminals. It is a genuine unknown at this stage. They all have different motivations." He warned that the attacks should serve as a wake-up call for businesses and organisations across the UK, including those responsible for essential services.
Underinvestment in technology
Dr Horne said technology underpinned almost every aspect of daily life, but warned that many organisations had failed to properly invest in updating the systems they relied on. He said: "The fact is technology underpins everything we rely on in our everyday lives. It is not just IT but operational technology that controls physical things, like electricity switching, water, and refrigeration units. And that technology base that we rely on as a society has not been invested in the way to the extent it should have been."
He added: "Many organisations have sweated their assets, have extended use of systems beyond their end of life and not kept them upgraded. And that leaves a whole load of vulnerabilities that now AI, in the hands of our adversaries, can enable them to find with ease and exploit."
He said weaknesses existed in technology responsible for keeping homes supplied with electricity and water, as well as ensuring food remained available in shops. "There are vulnerabilities in all sorts of technologies, keeping our lights, keeping our water running, keeping food on the shelves," he said. "They all rely on technology to be there, to be operating correctly and on much of that technology there is vulnerability that shouldn't be there and we need all organisations to invest in renewing their technology."
Rising threat from artificial intelligence
The warning comes as the NCSC's annual report raised concerns about the growing threat posed by artificial intelligence, with Britain facing a potentially critical moment for its national cyber security. Dr Horne described the current situation as a moment of "enormous consequence", comparing it to the film Sliding Doors, in which a seemingly small decision can change the course of events.
He warned that the UK faced the prospect of an unprecedented rise in cyber incidents in the coming months, as artificial intelligence makes it easier for hostile actors to identify and exploit weaknesses in outdated systems. In a speech launching the report, he said: "It is clear that our nation is living through a moment that, in hindsight, we will see as one of enormous consequence. A 'sliding doors' moment. A moment of choice. In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."
He warned of the potential consequences of failing to act, saying: "When food isn't on shelves, lights aren't on, businesses have gone under, we may have to explain that we saw the warning signs, understood the risks and still didn't make the right choices."
The report also warned that hackers demanding ransom payments were "highly likely" to use artificial intelligence to target the UK by 2028. Hostile states, including Russia and China, are also expected to routinely use the technology to pursue their objectives by that point.
Figures in the NCSC report show its incident management team received 1,831 reports of cyber attacks during the year. Of those, 337 required support from the agency, while 80 were classed as nationally significant. The team also warned 8,500 organisations after discovering their systems had been compromised by attackers.
