British food businesses have been affected by a cyber attack targeting supermarket refrigeration systems across Europe, the head of the National Cyber Security Centre (NCSC) has confirmed.
Dr Richard Horne, who leads the organisation within GCHQ, said hackers had exploited vulnerable technology in the UK, although the full extent of the impact remains unclear.
Security sources told the Daily Mail that only a small number of British companies had been affected.
“We don’t know the full impact, but we can see there are a couple of instances where vulnerable technology has been exploited, and we will be working with those organisations to understand more,” Horne said.
He added that investigators could not yet identify those responsible for the attacks.
Freezer Temperatures Rose as Refrigeration Systems Were Targeted
The cyber attack has affected businesses in at least seven European countries, with dozens of shops in Belgium, Sweden, Ireland, Luxembourg and Estonia among those targeted.
The latest incidents involved refrigeration units manufactured by Belgian company Sabcobel. The firm said hackers had switched the units’ evaporators into defrost mode, causing temperatures to rise sharply.
Some freezers reportedly heated from -27C to as high as 50C, resulting in large quantities of meat being spoiled.
Reports also indicated that temperatures in some affected cooling units reached as high as 55C.
Photographs from Sweden showed employees removing spoiled food from an ICA supermarket and cleaning refrigeration units following the incident.
Belgian and Luxembourg Supermarkets Among Those Hit
Around 40 Delhaize and Colruyt supermarkets in Belgium and Luxembourg were affected, alongside 15 Carrefour stores.
The latest incident followed a similar attack on French supermarkets the previous month, when hackers interfered with refrigeration systems in hundreds of grocery stores.
That incident resulted in millions of euros’ worth of food being discarded and reportedly caused several small fires.
The attacks also involved refrigeration equipment supplied by Danfoss, a company whose products are used by British supermarket chains including Tesco and Sainsbury’s.
UK Meat Businesses Report Refrigeration Disruptions
Some British businesses involved in the food supply chain also experienced problems after their refrigeration systems were affected.
Tony Goodger of the Association of Independent Meat Suppliers said several of the organisation’s 300 members had unexpectedly been caught up in the incident.
He reported that refrigeration units had heated up overnight. However, the affected equipment was empty at the time, meaning no food products were lost.
Goodger explained that the way abattoirs operate meant the disruption did not affect meat supplies.
NCSC Alerts Businesses to Vulnerable Systems
Horne said the cyber-security agency had been working overnight to contact organisations whose systems could be exposed to similar attacks.
Speaking on BBC Radio 4’s Today programme, he said the threat extended beyond supermarkets to the wider food supply chain.
“It’s not just supermarkets, it’s through the whole food supply chain, and we’ve been working through the night alerting organisations where we can see they’ve got exposed technology that’s vulnerable in this way,” he said.
He added that the agency had alerted a handful of UK organisations and was aware of a couple of cases in which businesses had been affected.
An NCSC official confirmed that a small number of British organisations might have been impacted because of vulnerabilities in their systems.
The agency said it was supporting affected businesses and working with international partners and relevant industries to assess the incident and limit its consequences.
No major British supermarket chain is understood to have been directly affected.
NCSC Warns of Growing Threat From AI-Powered Cyber Attacks
The confirmation of the freezer attacks came as Horne warned that the UK was approaching a critical period for national cyber-security.
Speaking as the NCSC published its annual report, he said Britain faced the possibility of an unprecedented increase in cyber incidents as artificial intelligence made it easier for attackers to identify and exploit weaknesses in computer systems.
The report warned that AI-powered attacks could increasingly target critical national infrastructure over the next two years.
It also found that ransomware criminals were highly likely to use the technology against UK targets by 2028, while hostile states, including Russia and China, were expected to make routine use of AI to advance their objectives.
Horne described the situation as a moment of major consequence for the country.
He said vulnerabilities that had existed for years could now be identified and exploited on a scale that was previously unimaginable.
Cyber-Security Weaknesses Linked to Years of Underinvestment
Horne also criticised the long-standing approach to technology investment in Britain, saying organisations had often delayed necessary upgrades to reduce costs.
He said outdated systems had frequently been kept in operation for another year, while essential improvements were postponed under the label of cost efficiency.
He also highlighted concerns about technology providers failing to make security a standard feature of their products and services.
“ For decades, we have collectively got away with doing tech on the cheap,” Horne said.
His warning followed comments from Defence Secretary Wes Streeting, who had said Britain needed to be prepared for war within the next 1,000 days.
The Government has also launched a national resilience campaign encouraging households to keep enough food and water to last three days.
NCSC Records More Than 1,800 Cyber Attack Reports
The agency’s annual report revealed that its incident management team received 1,831 reports of cyber attacks during the year.
Of those cases, 337 required support from the NCSC, while 80 were classified as nationally significant incidents.
The report also stated that 8,500 organisations had been identified as having systems compromised by attackers.
Separate research by Mastercard found that 46 per cent of small businesses in the UK had been targeted by cyber criminals during the previous year.
The study also reported that nearly one in five small businesses, equivalent to 18 per cent, had gone bankrupt following a cyber attack.
More than three in five small and medium-sized companies, representing approximately 3.4 million businesses, were found not to use any cyber-security tools.
