Are UK supermarket fridges at risk of cyber attack after outages left Europe stores with empty shelves?

Cyber hackers have targeted fridges and freezers in European supermarkets including Ireland – leaving many wondering whether the UK could be next to suffer.

Ireland, Sweden, Belgium, Luxembourg, the Netherlands and Estonia have been targeted less than a month after a similar incident affected hundreds of supermarkets in France.

Hundreds of stores have been left with empty shelves as frozen and chilled products have had to be removed from sale on Monday (November 2).

Irish supermarket chain, ​SuperValu, said a specific model of its refrigeration system ⁠in ⁠13 of ‌its 223 stores ‌had been affected.

Sweden's cyber security centre said it was responding to several incidents ​in ICA and Co-op grocery stores, while IKEA said that one of its outlets in Belgium had been impacted and that it couldn’t rule out others being affected.

What happened in France?

Monday’s cyber attack comes less than a month after hundreds of supermarkets in France were targeted by a similar cyber attack, which resulted in temperatures in some fridges rising to 50C and sparking fires.

Les Mousquetaires, which ⁠owns retailer Intermarche, said that approximately 150 of its stores were affected and all food had to be disposed of.

No one has yet claimed responsibility for the attack.

Cyber minister Baroness Lloyd of Effra told an audience in central London that the attack on French supermarkets was an “exploitation of known vulnerabilities”.

So, what does this mean for the UK?

The chief executive of the National Cyber Security Centre said vulnerable technology has been exploited in the UK following apparent cyber attacks on supermarket freezers across Europe.

Dr Richard Horne told BBC Radio 4’s Today programme that the threat spans the whole food supply chain, not just supermarkets. The agency worked through the night to alert organisations with exposed technology, warning a handful in the UK and identifying a couple of impacts.

Asked whether freezers in Britain had been switched to defrost, he said the full impact remained unknown, although vulnerable technology had been exploited in a couple of instances.

Dr Horne said the attacks reinforced warnings that people should stockpile and urged organisations to invest in renewing vulnerable technology. Emphasising personal responsibility, he said: “It’s your business. It’s your charity. It’s your life. You need to make the choice and choose wisely.”

Asked who was behind the attack, he said it was “too early” to give a definitive answer.

Dr Horne claims the “UK has got away with doing ‘tech on the cheap’ for decades”, as the NCSC’s annual report suggests Britain faces the prospect of AI-boosted attacks on critical national infrastructure in the next two years.

Speaking at the launch of the National Cyber Security Centre’s annual report, Baroness Lloyd of Effra added that too many UK firms are at risk because they have not taken basic action to keep systems secure.

She added that digital infrastructure remains outdated and vulnerable, with organisations relying on legacy systems and that poor cyber hygiene continues to put organisations at risk.

Should I stockpile?

The Government’s “be ready” campaign urges households to prepare for disruptions by keeping three days’ supplies—water, food, a radio, and cash.

This is the first step in a three-year effort to help people handle events like severe weather, after recent UK heatwaves and fires.

Households should also check essentials and consider registering for priority services to get extra support during outages.

To take a look at the government checklist, click here.

How is AI increasing the risk of attack?

Hackers demanding ransom payments are “highly likely” to use AI to target the UK by 2028 and hostile states such as Russia and China will routinely use the technology to pursue their goals by then, the report found.

The NCSC annual report said that its incident management team received 1,831 reports this year of cyber attacks, of which 337 required support and 80 were nationally significant.

The team also warned 8,500 organisations when their systems had been compromised by attackers, the report added.