UK food suppliers hit by cyber-attacks on freezer controls
The Guardian reports UK meat and produce suppliers were hit by attacks on internet-connected refrigeration, after similar incidents at European retailers.
The story in focus
The Guardian reports UK food suppliers, including members of the British Association of Independent Meat Suppliers, were hit by cyber-attacks that manipulated internet-connected refrigeration controls, following incidents at retailers in several European countries. The NCSC said national impact was minimal, while researchers logged 256 attempted attacks on decoy fridge controllers.
- Some of the British Association of Independent Meat Suppliers' more than 300 members were affected as collateral in the hack, with no meat lost.
- One meat supplier saw cold units rise to up to 100C; two others reported units defrosting, and all affected units were empty.
- A London fruit and vegetable wholesaler stopped the attack by disconnecting its cold storage units from the internet.
- Lupovis recorded 256 attempted attacks from 91 sources on decoy Danfoss fridge controllers between 20 and 30 October.
- Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported refrigeration problems; France had similar incidents last month.
Attacks reach UK suppliers
The Guardian reports that food suppliers in the UK were hit by cyber-attacks after hackers raised the temperatures of supermarket freezers across Europe. The National Cyber Security Centre said it was working with affected companies and that the national impact was minimal. Its director of operations, Paul Chichester, said the incidents were not AI-enabled and used vulnerabilities that had been present for a long time.
The British Association of Independent Meat Suppliers said some of its more than 300 members were affected as collateral in the hack. No meat was lost, but one meat supply company saw cold units rise to up to 100C while two others reported units had started to defrost. The association said the affected units were empty at the time.
Wholesaler disconnects cooling
A London fruit and vegetable wholesaler, Langridge Organic, prevented the attack from escalating by pulling the internet connection to its cold storage units out at the wall. Managing director Alex Pearce said hackers changed parameters on several units, setting them to defrost for more than four hours at 150C, and staff intervened before stock was damaged. Pearce said the company uses the same fridge control system, developed by US software company Copeland, that was involved in French supermarket incidents. Copeland said it is talking to affected customers and has recommended software fixes.
Researchers log decoy attacks
Cybersecurity researchers at Lupovis recorded 256 attempted attacks from 91 different sources between 20 October and 30 October after setting up online honeypot traps designed to resemble Danfoss fridge controllers. Most authentication attempts used the manufacturer's publicly documented factory-default credentials. Lupovis chief executive Xavier Bellekens said the infrastructure overlapped with infrastructure previously associated with Russian-linked malicious operations, though no group has been identified.
Did the UK freezer cyber-attacks cause any food losses?
The British Association of Independent Meat Suppliers said no meat was lost. One meat supplier's cold units rose to up to 100C and two others began defrosting, but the affected units were empty.
Sources & further reading
Help keep the record accurate. Send a correction.
