Freezer cyberattacks in Europe expose a weak link in the food supply chain
Subscribe to our free newsletter today to keep up to date with the latest food and beverage news.
A number of UK meat processors have had their refrigeration systems tampered with in a wave of cyberattacks that first hit supermarket freezers in mainland Europe. The UK incidents came to light on Nov. 3, with the National Cyber Security Centre (NCSC) confirming it was working with the organizations affected.
Fridges at the affected processing sites heated up overnight. The Association of Independent Meat Suppliers (AIMS), which has around 300 members, said a few of them were hit. The UK firms used the same refrigeration software as the European supermarkets targeted in the campaign, which left them exposed to an attack that was not aimed at them.
No meat was lost. Abattoirs typically run their chilled units empty overnight, so there was no produce inside when the temperatures rose. No major UK supermarket chain has been directly affected.
The NCSC described the national impact as minimal. The incident still raises an uncomfortable question for food businesses about how many of the systems that keep food safe are connected to the internet with little protection.
Refrigeration controls have become a target for hackers
Rather than stealing data or locking files for ransom, the attackers went after temperatures. According to the NCSC, some freezers were switched to defrost. The agency has alerted a handful of UK organizations and confirmed that a couple were affected. It has not confirmed the full impact, and its head, Richard Horne, said it was too early to say who was behind the attacks.
It has also emerged that an earlier attack on French supermarkets involved older refrigeration technology connected to the internet and protected only by default passwords. That detail matters because many cold stores, display cabinets, and plant chillers are managed through remote monitoring software that lets engineers check temperatures and change settings from anywhere. The convenience that makes these systems useful also makes them reachable by anyone who finds a way in.
For the food industry, the risk is different from most cyber incidents. A breach of an office network usually costs time and money. A breach of a temperature control system can spoil stock, force product withdrawals, and, if it goes unnoticed, allow unsafe food to move further down the supply chain.
The UK processors were saved by their timing
Had the units been full, processors would have faced a hard choice between discarding product and proving it had stayed within safe limits throughout the incident. Proving it would depend on temperature records held by the same system that had been compromised.
The British Retail Consortium (BRC) said retailers are working with the NCSC to secure their fridges and freezers. Retailers are being urged to monitor their systems, keep software up to date, and prepare contingency plans for moving food if refrigeration fails.
According to the NCSC’s latest annual report, which puts the incident in a wider frame, the agency received 1831 cyberattack reports this year, of which 337 needed its support and 80 were judged nationally significant. It also warned 8500 organizations that their systems had been compromised.
Against those numbers, a few overheated fridges at empty abattoirs look minor. The method is what should concern the industry.
Food businesses need to treat cold chain controls as security assets
The practical lessons are familiar, but this campaign shows they apply to equipment that many businesses treat as plant rather than IT. Default passwords need changing. Remote access needs limiting and logging. Older controllers that cannot be updated may need to come off the internet or be replaced.
Food safety and cybersecurity often sit with different teams. Temperature monitoring is usually owned by operations or quality staff, while network security belongs to IT. An attack on refrigeration falls between the two, and it is not always clear who is responsible for closing the gap.
Auditors and insurers may start asking harder questions too. Food safety schemes already require businesses to control and record temperatures. Whether they will also look at how securely those controls are connected is an open question.
The biggest unknown is who carried out the attacks and why. Without that, it is hard to judge whether this was a test, a disruption campaign, or the start of something larger. For processors and retailers heading into their busiest trading weeks of the year, the safer assumption is that refrigeration systems are now on attackers’ radar, and the next incident may not come on a night when the fridges are empty.
Source
ITV News
