Food Suppliers in the UK Targeted by Cyber Attacks Affecting Refrigeration Systems

Cyber attacks have recently plagued food suppliers across the UK as hackers manipulated supermarket freezer temperatures. This alarming situation unfolded across several European countries, prompting swift responses from cybersecurity agencies.

The UK’s National Cyber Security Centre (NCSC) reported that it is collaborating with the affected organizations to address the situation, asserting that the overall national impact remains limited. In a statement during the release of the NCSC’s annual review, Director of Operations Paul Chichester noted, “We’re aware of those incidents in the UK, and obviously we’re working with the affected organisations. We’ll keep monitoring that. At the moment, the impact is minimal.”

Experts in cybersecurity revealed that the breaches involved attacks on “dummy” fridge controls, which had been intentionally set online to attract potential hackers. These incidents showed signs that pointed towards malicious operations associated with Russia.

On Monday, retailers in countries such as Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden reported rising temperatures in their refrigeration systems, reaching as high as 50°C (122°F), with several organizations confirming successful breaches. Similar attacks were also noted in France the previous month, where compromised systems utilized outdated technology with default security settings.

While no grocery chains in the UK have faced direct consequences so far, Chichester emphasized the NCSC’s commitment to identifying technological vulnerabilities and preventing further exploitation. He indicated that the attacks did not involve AI capabilities and exploited vulnerabilities that had been known for some time.

According to Richard Horne, the NCSC’s chief executive, the recent fridge attacks signify merely the “foothills” of a broader cyber threat landscape, particularly as AI advancements reveal weaknesses in IT networks previously overlooked by their operators. Horne remarked, “There are so many vulnerabilities out there that … you could say are waiting to be exploited.”

In response to the situation, the British Association of Independent Meat Suppliers stated that some of its members experienced disruptions as “collateral” damage due to the hacks. Importantly, no meat was reported lost, but officials view the incidents as a wake-up call for the entire food production chain.

One affected meat supply company raised its cold units to staggering temperatures of up to 100°C. Another company averted disaster by disconnecting from the internet when it detected unusual activity. Managing Director Alex Pearce of Langridge Organic revealed that hackers had altered the temperature settings of several units, causing them to defrost at extreme temperatures for extended periods. Fortunately, intervention occurred before any inventory was compromised.

Pearce mentioned that they utilized the same fridge control system developed by Copeland, which had also been involved with the previous French incidents. In another case, a fruit and vegetable wholesaler in London managed to thwart the attack by pulling the internet connection to their cold storage units.

Cybersecurity analysts noted that the attacks on dummy Danfoss fridge controls exhibited patterns similar to recent operations associated with Russian actors. Xavier Bellekens, CEO of Lupovis, reported a significant number of attempted breaches from a variety of sources during an analysis period last month. These attacks primarily employed the manufacturer’s publicly available factory-default credentials.

“What caught our attention was the overlap between infrastructure involved in the recent probing activity and infrastructure we have previously associated with Russian-linked malicious operations,” Bellekens stated. The use of what is termed “bulletproof” hosting demonstrates how attackers can remain hidden while exploiting vulnerabilities.