Supermarket freezer hacks: how vulnerable is the UK?

Hackers are targeting the technology controlling supermarket fridges and freezers across Europe, causing disruption, ruining millions of euros worth of food, and raising serious concerns about how prepared the UK is for a similar assault.

What has happened?

Supermarkets in several countries have been hit by cyberattacks that hit their refrigerated and frozen food storage units. In Belgium, Ireland and Sweden, an IT incident left cold storage units malfunctioning after attackers exploited security flaws in their internet-connected controllers.

Hackers can access the controls of digital refrigeration systems and turn their temperatures up very high, turning an everyday piece of supermarket equipment into a tool for disruption.

The attacks began last month, when hundreds of French supermarkets were left with “spoiled food” and overheated equipment, causing damage costing millions of euros, said Al Jazeera. It is a “very cold war”.

How vulnerable is the UK?

Some British supermarket fridges have also been affected, although the incidents are thought to be “isolated and not widespread” at this stage, said The i Paper.

Richard Horne, chief executive of the National Cyber Security Centre, confirmed there had been a “couple of instances” in which cold food storage units in the UK had been exploited by hackers.

The threat extends beyond supermarkets, however. Disruption has been identified across the wider food supply chain, with the full impact still unclear. Meat processing firms in the UK were hit by cyberattacks and the NCSC is working to understand the extent of the problem and identify vulnerable technology.

Meanwhile, Horne warned that the UK’s underlying technology infrastructure “has not been invested in to the extent it needs to be”. Many organisations continue to rely on ageing systems that have reached the end of their useful lives or have not been properly updated. This leaves “a whole load of vulnerabilities” that artificial intelligence, in the hands of hostile actors, can help identify and exploit with ease.

The NCSC has also warned that AI-powered malware could be used to attack critical national infrastructure in Britain within the next two years, including airports, hospitals and power stations.

The risks are not limited to businesses. Increasing numbers of household appliances are connected to the internet, including fridges, freezers, smart thermostats, central heating systems, locks and televisions, said The Independent.

As everyday services become more dependent on connected technology, the opportunities for disruption grow. So “we need to get used to the chaos and confusion” because “hits on networks and services that affect our everyday life are coming for us in due course”.

What can be done about it?

For the companies and organisations affected, the simplest fix is to patch their software systems. According to the Belgian refrigerator group Sabcobel, the impact of Monday’s hack could have been far worse if they had not started patching fridges after the 12 October attack in France.

In the UK retailers are “currently working with the NCSC to ensure their fridges and freezers are secure as possible against potential attacks”, said Graham Wynn, from the British Retail Consortium.