UK food businesses suffered collateral damage from a cyber-attack that targeted supermarket refrigeration units across Europe on Monday, the National Cyber Security Centre said.
The NCSC confirmed "a couple of instances" in the UK where vulnerable technology had been exploited. The British Association of Independent Meat Suppliers said two of its more than 300 members saw fridges begin to defrost, while another's cold units rose to 100 degrees Celsius. AIMS spokesman Tony Goodger said the affected devices were empty so no produce was lost, but called the incident "a reminder to all in the food industry" that "their businesses may be seen by some as targets."
The attack hit supermarkets in Ireland, Sweden, Estonia, Belgium, and the Netherlands. Around 40 Delhaize supermarkets in Belgium and Luxembourg were affected. Sabcobel, which manufactures some refrigerators, said the units' evaporators were switched to defrost mode.
Belgian and Luxembourg retailers reported throwing away hundreds of thousands of euros in spoiled food. Mathieu Tilman, who runs a Delhaize store in Belgium, told the BBC he found it "truly distressing" given food waste amid global hunger.
The incident echoed an attack on French supermarkets in early October that exploited vulnerabilities in refrigeration control systems previously identified by cybersecurity researchers. NCSC chief executive Dr Richard Horne said it was "too early to say" who was behind the attacks but called for businesses to update outdated technology and disconnect systems from the internet. He said many firms had extended systems beyond their end of life and created vulnerabilities that "can be easily exploited."
The NCSC said impact in the UK remained minimal so far and it was working with organisations to close existing vulnerabilities.