Cyber attacks raised refrigeration temperatures at UK meat suppliers and European freezers

Cyber-attacks raised temperatures in refrigeration units used by UK meat suppliers and supermarket freezers across Europe on Monday.

AIMS said attackers had affected some of its members, a group of more than 300 suppliers. The cold units were empty when attacked, so no meat was lost. Units at one member rose to 100C, while units at two others began defrosting. Tony Goodger, AIMS head of communications, said businesses across the food supply chain could be targeted by similar incidents.

The UK National Cyber Security Centre said it knew of a couple of instances in Britain involving vulnerable refrigeration technology that had been exploited. The center worked with affected organizations and said the national impact stayed minimal. Paul Chichester, the NCSC’s director of operations, said at the annual review launch on Tuesday that the agency monitored the incidents. “At the moment, the impact is minimal,” Chichester said.

Richard Horne, the NCSC chief executive, said on BBC Radio 4’s Today programme that staff had worked through the night to warn organizations across the UK that might be affected. Horne said it remained too early to identify those responsible.

Horne said the fridge attacks were the foothills of a larger cyber threat facing companies and the public, with AI (artificial intelligence) systems exposing flaws in IT networks that owners had not seen or had failed to patch. He said society’s technology base had not received enough investment, with many firms running systems past end of life without upgrades or secure offline compartments. Those actions created vulnerabilities that amounted to low-hanging fruit for hackers. He said AI used by adversaries could make those weaknesses easier to discover and exploit.

“For decades, we have collectively got away with doing tech on the cheap,” Horne said in a speech accompanying the NCSC report. He urged organizations to put money into modernizing technology, cut unnecessary internet connections and treat cybersecurity as fundamental to operations.

On 3 November, the NCSC released its State of the Cyber Nation report, saying AI-powered malware was highly likely to be used in a ransomware attack on Britain’s critical national infrastructure by 2028. It also warned that criminals and hostile actors were more likely to use AI to find weaknesses, exploit vulnerabilities and conduct attacks more efficiently.

Grocery chains in the UK had not been directly affected up to that point. A London wholesaler of fruit and vegetables was affected, but stopped the attack from growing by pulling its cold storage units’ internet connection from the wall.

Alex Pearce, who manages Langridge Organic, said hackers changed settings on several units to make them defrost for more than four hours at 150C, but his team acted before stock was harmed. Pearce said Langridge runs the same fridge control system from US software company Copeland that was involved in French supermarket incidents. Copeland said it was speaking with affected customers and had recommended software fixes.

Shops across Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported refrigeration problems on Monday, with some temperatures reaching as high as 50C (122F), and several companies confirmed they had been hacked. In Belgium and Luxembourg, about 40 Delhaize supermarkets were affected in Monday’s incident. A smaller number of shops in Sweden, Ireland, the Netherlands, Estonia and Finland were also hit. The overnight hack targeted hundreds of stores, spoiling fresh and frozen food estimated to be worth millions of euros.

SuperValu in Ireland said refrigeration systems at 13 of its 223 stores were affected, forcing chilled and frozen products off sale. In Sweden, ICA and Co-op reported incidents, and one ICA store said its fridges and freezers reached 50C.

In Belgium, Ahold Delhaize, Carrefour and Spar stores were affected, with more incidents in Luxembourg, the Netherlands and Estonia. A Belgian butcher said he lost about 15,000 euros of meat when refrigeration temperatures rose to 18C. Mathieu Tilman, who runs a Delhaize supermarket in Belgium, said throwing away so much food while people went hungry was truly distressing.

Researchers said attacks on dummy Danfoss fridge controls targeted by hackers in mainland Europe showed features similar to malicious operations linked to Russia. Xavier Bellekens, chief executive of cyberdefence firm Lupovis, said his firm recorded 256 attack attempts from 91 sources between 20 October and 30 October using online honeypot traps that looked like real Danfoss fridge controllers. Most login attempts on the dummy controls used the maker’s publicly documented factory-default username and password, and the attackers stayed anonymous.

The attackers relied on bulletproof hosting, which means internet service providers that tolerate malicious activity and often ignore abuse complaints or make it hard for authorities to disrupt customer operations. Bellekens said infrastructure used in the recent probing overlapped with infrastructure previously linked to Russian malicious operations, though the firm could not identify a specific group. He said relatively few actors fit this profile, and the bulletproof hosting seen in the probing had also been used by Russian groups in the past.

The NCSC said the attacks did not involve AI and exploited long-standing vulnerabilities. Ollie Whitehouse, the NCSC chief technology officer, said everyday devices connected to the internet could be hacked in some situations. He said manufacturers should be encouraged to build safer technology, and consumers should be ready to pay more for it.

France saw similar incidents last month, involving legacy internet-connected technology with default passwords. Sabcobel, a Belgian maker of some of the affected refrigerators, said evaporators in the units were switched to defrost mode, making them warm up. The defrost method was believed to match last month’s attack on hundreds of French supermarkets. Weeks earlier, hackers had remotely raised refrigeration temperatures at hundreds of French supermarkets, destroying chilled and frozen goods worth millions of euros.

Better Retailing previously revealed that cyber security firm UK Cyber Defence found at least 800 refrigeration and building-control systems in Britain exposed to potential cyber attacks through the internet. Peter Bassill, head of threat disruption at UK Cyber Defence, had not established whether any of the exposed systems were owned by independent retailers. He warned that convenience stores could be vulnerable through connected equipment such as CCTV cameras, burglar alarms, lighting, heating and air conditioning, some accessible over the public internet.

Bassill said many businesses rely on third-party suppliers to install and maintain connected equipment, so retailers need to know who is responsible for keeping systems secure. Paul Jordon, managing director of The Jordon Group, said smaller independent retailers were unlikely to be targeted directly, but stores with remotely controlled systems faced greater risks. He advised retailers to install the latest firmware and security updates and avoid legacy equipment.

James Griffiths, founder of cybersecurity consultancy UtopianKnight, said an attack on a wholesaler, payment provider or other essential supplier could affect independent retailers indirectly. Griffiths said businesses should plan how to keep trading if a vital system or supplier stopped working. Graham Wynn, assistant director of regulatory affairs at the British Retail Consortium, said retailers invest heavily in cybersecurity and work with the NCSC to keep fridges and freezers as secure as possible against potential attacks.