Fridge Hacks Expose Weak Links in UK Food Supply

A few meat suppliers saw refrigeration systems start to defrost after cyber attacks, but no food was lost, the Association of Independent Meat Suppliers (Aims) said. One unit’s temperature rose to 100C. The National Cyber Security Centre (NCSC) called the national impact “minimal” and said it was working with affected firms.

For businesses that depend on connected equipment, a hacked setting can turn an ordinary workday into an urgent effort to keep systems running. At Langridge Organic, hackers got into six of its 10 fridges on Monday morning. Managing director Alex Pearce told BBC Radio 4’s PM programme that no stock was affected, but manual checks found abnormal temperatures and defrost settings.

A supply chain on alert

Pearce said he suspected a hack and unplugged the Cat cable. “I reckon I caught them by luck right in the middle of it being hacked,” he said. Unplugging it stopped the other fridges, and staff reset the settings. Six, seven or eight parameters in each fridge had changed, he said, “to make our lives a bit difficult on a Monday morning”.

The affected units at Aims members were empty because of the way abattoirs typically operate, so no meat was affected. Aims represents roughly 300 members. Its spokesman said: “None who have been affected have lost any meat, but once again this must act as a reminder to all in the food industry, at whatever point in the supply chain they are, that their businesses may be seen by some as targets.” He urged members and the wider industry to stay vigilant.

No major supermarket chain was directly affected, according to the report. Retailers were urged to monitor systems for potential risks, keep software up to date and prepare contingency plans in case food needed to be relocated. The British Retail Consortium’s assistant director of regulatory affairs, Graham Wynn, said retailers invest heavily in cybersecurity and work with the NCSC to make fridges and freezers as secure as possible. Rupert Ashby, chief executive of the British Frozen Food Federation, said retailers across the supply chain were taking cybersecurity seriously and assessing freezer systems for vulnerabilities.

The centre’s warning—and its limit

Paul Chichester, director of operations, said the NCSC was working with affected organisations and monitoring the incidents. “At the moment, the impact is minimal,” he said at the launch of the NCSC annual report on Tuesday. The centre was working with organisations to find existing vulnerabilities in the UK and close them before attackers could exploit them.

Head of the NCSC Dr Richard Horne said teams worked through the night to alert British firms vulnerable to such an attack. The cyber attack on French supermarket fridges involved legacy technology connected to the internet with default passwords. Horne said the centre had alerted “handfuls of organisations in the UK” and knew of a couple of impacts.

Asked whether the attack reinforced warnings from the Defence Secretary that people in the UK should stockpile, Horne answered: “Absolutely.” He added: “We alert people. We intervene where we can. But, at the end of the day, it's your business. It's your charity. It's your life. You need to make the choice and choose wisely.” The warning puts responsibility for preparedness on individual organisations and people, even as the NCSC intervenes where it can.

The NCSC annual report recorded 1,831 reports of cyber attacks received by its incident management team this year. Of those, 337 required support and 80 were nationally significant. The team also warned 8,500 organisations that attackers had compromised their systems. The centre’s “minimal” assessment concerns the national impact of these fridge incidents; its own figures show a much wider stream of reported attacks and warnings.