UK Meat Suppliers Assess Impact as European Refrigeration Systems Face Cyberattacks

Meat suppliers across the United Kingdom have been affected by cyberattacks after hackers remotely increased temperatures in supermarket freezers throughout Europe.

The United Kingdom’s National Cyber Security Centre stated it is collaborating with affected companies, though the national impact remains minimal.

Speaking at the launch of the NCSC’s annual review on Tuesday, Paul Chichester, the agency’s director of operations, said: “We are aware of these incidents in the UK and are working with the affected organizations. We will continue monitoring the situation. At present, the impact is minimal.”

Cybersecurity experts noted that attacks on “dummy” refrigerator controls—deliberately exposed online to attract malicious actors—showed characteristics consistent with operations linked to Russia.

Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden reported issues with their refrigeration systems on Monday. In some cases, temperatures climbed as high as 50°C (122°F), and several companies confirmed they had been hacked. Similar incidents occurred in France last month, where the attack on supermarket refrigerators involved legacy technology connected to the internet using default passwords.

No UK grocery chain has been directly affected to date.

Chichester explained that the NCSC, part of the GCHQ intelligence agency, is working with organizations to identify technology vulnerabilities and close them before hackers can exploit them.

He added that the NCSC could not identify who might be responsible for the attacks, but noted they were not AI-enabled and relied on vulnerabilities that have existed for a long time.

Richard Horne, the NCSC’s chief executive, said the refrigerator attacks represent the “foothills” of a growing cyberthreat facing businesses and the public, as AI systems expose flaws in IT networks that owners may be unaware of or have failed to patch.

“There are so many vulnerabilities out there waiting to be exploited,” he added.

Ollie Whitehouse, the agency’s chief technology officer, said everyday internet-connected domestic devices could be vulnerable to hackers in certain situations. He urged manufacturers to produce safer technology and noted that consumers may need to accept higher prices for more secure equipment.

The British Association of Independent Meat Suppliers said some of its more than 300 members were affected after becoming “collateral” damage in the hack.

The trade body confirmed no meat was lost in the refrigeration breaches. However, it described the incidents as a reminder to everyone in the food supply chain that their operations could be viewed as targets.

One supply company saw its cold-storage units rise to 100°C (212°F), while two others reported that their units began defrosting. The association said the affected units were empty at the time. The Grocer, a trade publication, also reported that a London-based fruit and vegetable wholesaler was affected but did not lose any stock.

Cybersecurity researchers said attacks on dummy Danfoss refrigerator controls—targeted by hackers across mainland Europe—resembled recent operations linked to Russia.

Xavier Bellekens, chief executive of cyberdefense firm Lupovis, said his company recorded 256 attempted attacks from 91 different sources between October 20 and October 30 after deploying online “honeypot” traps indistinguishable from real Danfoss fridge controllers.

The attackers attempting to seize control of the dummy controls remained anonymous, but most authentication attempts used the manufacturer’s publicly documented factory-default username and password credentials.

They also used what Bellekens described as “bulletproof” hosting—involving internet service providers tolerant of malicious activity, often ignoring abuse complaints or obstructing authorities trying to disrupt their customers’ operations.

“What caught our attention was the overlap between infrastructure involved in the recent probing activity and infrastructure we have previously associated with Russian-linked malicious operations,” he said.

“While we cannot yet identify a specific group, the number of actors fitting this profile is relatively small. The bulletproof hosting used by these actors for probing was also used by Russian groups in the past,” he added.

Source link