Meat processing firms in the UK have been hit by cyber attacks after hackers targeted supermarket freezers across Europe. The National Cyber Security Centre (NCSC) said it is working with the affected firms and that the national impact is “minimal”.
NCSC Response and Impact
Speaking at the launch of the NCSC annual report on Tuesday, Paul Chichester, director of operations, said: “We’re aware of those incidents in the UK, and obviously we’re working with the affected organisations. We’ll keep monitoring that. At the moment, the impact is minimal.”
He added: “We’re working with organisations identifying existing vulnerabilities in the UK and trying to get those closed before somebody exploits them.”
Head of the NCSC Dr Richard Horne said teams had been working throughout the night to alert British firms that are vulnerable to such an attack. It has emerged that the cyber attack on French supermarket fridges involved legacy technology connected to the internet with default passwords.
Vulnerabilities and Exploitation
Dr Horne told an audience at the report launch in central London: “Last night, we had people working through the night contacting organisations that we could see they had vulnerable technology exposed.” He earlier told the BBC Radio 4 Today programme: “There are handfuls of organisations in the UK we’ve alerted and we’re aware of a couple of impacts.”
Put to him that some freezers in this country have been switched to defrost, he said: “We don’t know the full impact, but we can see there are a couple of instances where vulnerable technology has been exploited, and we will be working with those organisations to understand more.” Speaking about who was behind the attack, he said: “It’s too early for us to say at the moment and give a definitive answer.”
Warnings and Future Threats
Asked if it reinforces warnings from the Defence Secretary that people in the UK should stockpile, he said: “Absolutely. And we saw criminal attacks last year impact retailers in the UK. We know it can happen, and we’ve seen it across Europe. We see all sorts of impacts of cyber attacks, and because technology underpins everything, and because there is so much vulnerability in the technology we rely on because it’s been underinvested in, we do need all organisations to look at what they rely on, to invest in renewal, and, at the end of the day, we work 24 by seven. We alert people. We intervene where we can. But, at the end of the day, it’s your business. It’s your charity. It’s your life. You need to make the choice and choose wisely.”
In his speech launching the report, Dr Horne said that the UK is at risk because it has done “tech on the cheap” for decades, as the NCSC warned Britain faces the prospect of AI-boosted attacks on critical national infrastructure in the next two years. Hackers demanding ransom payments are “highly likely” to use AI to target the UK by 2028, and hostile states such as Russia and China will routinely use the technology to pursue their goals by then, the report found.
Call to Action
Dr Horne said: “It is clear that our nation is living through a moment that, in hindsight, we will see as one of enormous consequence. A ‘sliding doors’ moment. A moment of choice. In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable. And because far too many of our organisations and supply chains rest on weak technology and operational foundations.”
He warned that if businesses do not take action now, they will have to explain why they did not heed the warning signs amid empty supermarket shelves and power blackouts. “If leaders of organisations of every size and type do not take the responsibility now to make different choices, then they will one day have to look their investors, shareholders, employees, customers, suppliers, their families and friends in the eye and explain why, despite knowing the consequences, they failed to make the choices required. When food isn’t on shelves, lights aren’t on, businesses have gone under, we may have to explain that we saw the warning signs, understood the risks and still didn’t make the right choices.”
The NCSC annual report said that its incident management team received 1,831 reports this year of cyber attacks, of which 337 required support and 80 were nationally significant. The team also warned 8,500 organisations when their systems had been compromised by attackers, the report added.
Dr Horne said: “For decades, we have collectively got away with doing tech on the cheap. End-of-life systems kept running for just one more year, well-needed upgrades pushed back as a ‘cost efficiency’, and technology providers failing to invest in security by design and default.” He added: “Now that also carries through to the technology that underpins the automation of physical processes that are vital to modern life. Electricity switching, sluice gates in water facilities, dam operations, manufacturing lines, heating and refrigeration controls. Whilst they are not seen as traditional IT, they too are not built on the strong foundations they require. Their resilience and security is even more overlooked in investment decisions. Our resulting exposure as a society is huge and increasingly exploited in cyber attacks as we saw in the recent disruption of refrigeration units in supermarkets in France.”
He said China is best-positioned to use AI to target UK critical national infrastructure.
