The National Cyber Security Center (NCSC) says it is working with affected companies and the national impact is ‘minimal’.
A UK meat processing company has been the victim of a cyber attack after hackers targeted frozen supermarkets across Europe.
The National Cyber Security Center (NCSC) has confirmed that it is supporting affected businesses and that the national impact remains “minimal”.
Speaking at the launch of the NCSC’s annual report on Tuesday, Paul Chichester, director of operations, said: “We are aware of this happening in the UK, and obviously we are working with the organizations affected. We will continue to monitor.
“At the moment, the impact is minimal.”
He continued: “We are working with organizations that identify vulnerabilities that exist in the UK and are trying to close them before anyone exploits them.”
The Independent Meat Suppliers Association (AIM) said some of its approximately 300 members had been affected by the breach, with refrigeration units heating up overnight.
However, due to the typical operating pattern of slaughterhouses, the facility was empty at the time of the incident – meaning no food products were compromised.
A spokesperson for Aim explained that members using the same software as the affected European supermarkets were “unexpectedly collateral” in the hack.
“No one affected has lost meat, but once again this should be a reminder to everyone in the food industry, anywhere in the supply chain, that their business may be seen by some as a target,” he said.
“We urge our members and the wider industry to be vigilant.”
No major supermarket chain is believed to have been directly affected by the hack.
However, retailers are advised to maintain systems for potential vulnerabilities, ensure software is kept up-to-date, and have contingency plans in place should food products need to be moved elsewhere.
Graham Wynn, assistant director of regulatory affairs at the BRC, said: “Retailers are investing heavily in cyber security and are now working with the NCSC to ensure their fridges and freezers are safe from potential attacks.”
NCSC chief Dr Richard Horne said his team had been working through the night to warn UK businesses that could be vulnerable to the attack.
Since then, cyber attacks targeting French supermarket refrigeration units have used legacy technology connected to the internet using standard passwords.
Speaking to an audience at the launch of the report in central London, he said: “Last night we had people working through the night contacting organizations where they could see that vulnerable technology was exposed.”
Dr Horne previously told BBC Radio 4’s Today programme: “There are a number of organizations in the UK that have been alerted and we are aware of some of the impacts.”
When pressed on reports that some freezers in Britain have been switched to defrost mode, he said: “We don’t know the full impact, but we can see there are some cases where vulnerable technology has been exploited, and we will work with the organization to find out more.”
Speaking about who was responsible for the attack, he said: “It is too early for us to speak now and give a definite answer.”
When asked if it reinforced the warning from the Defense Secretary that people across the UK should stock up, he replied: “Absolutely. And we saw criminal attacks last year impacting retailers in the UK.
“We know it can happen, and we have seen it all over Europe. We see all kinds of impacts from cyber attacks, and because technology underpins everything, and because there are so many vulnerabilities in the technology we rely on because it has been underinvested in, we need all organizations to see what they rely on, to invest in renewal, and, at the end of the work24 by us seven days.
“We alert people. We intervene wherever possible. But, in the end, it’s your business. It’s your charity. It’s your life. You have to make a choice and choose wisely.”
Delivering a speech to launch the report, Dr Horne warned that the UK had not been seen to have pursued a “low-tech” approach for decades, as the NCSC warned that the UK faced the real prospect of AI-enhanced attacks on critical national infrastructure in the next two years.
Director of Operations for the National Cyber Security Center (NCSC), Paul Chichester speaking at the launch of the annual report, at the NCSC headquarters in central London(Image: James Manning/Press Association)
Ransomware hackers are “highly likely” to use AI to target the UK by 2028, while hostile countries such as Russia and China will routinely use the technology to achieve their goals by then, the report concluded. Speaking to launch the report on Tuesday, Dr Horne said: “It is clear that our nation is living in a moment which, in hindsight, we will see as having enormous consequences.
“The ‘sliding door’ moment. The moment of choice.
“In the coming months, we face the real prospect of unprecedented cyber incidents.
“But we must be clear that it is not because AI has found new ways to attack us, but because vulnerabilities that we have accepted for so long can now be discovered and exploited on an unimaginable scale.
“And because too many of our organizations and supply chains rely on weak technology and operational foundations.”
He warned that business leaders who failed to act today would be forced to do so for their inaction against a backdrop of empty supermarket shelves and widespread power outages.
“If the leaders of organizations of every size and type do not take responsibility now to make different choices, then one day they will have to look at investors, shareholders, employees, customers, suppliers, family and friends and explain why, despite knowing the consequences, they failed to make the necessary choices.
“When the food is off the shelves, the lights aren’t on, the business is gone, we may have to explain that we see the warning signs, understand the risks and still don’t make the right choices.”
The NCSC’s annual report revealed that its incident management team handled 1,831 reports of cyber attacks this year, with 337 requiring support and 80 deemed nationally significant.
The team also alerted 8,500 organizations after their systems were breached by attackers, according to the report.
Dr Horne said: “For decades, we have been doing technology together on the cheap.
“End-of-life systems remain operational for another year, required upgrades are pushed back as ‘cost efficiencies’, and technology providers fail to invest in security by design and standards.”
He added: “Now it also brings technology that supports the automation of physical processes that are essential to modern life.
“Electrical switching, sluice gates in water facilities, dam operations, manufacturing lines, heating and cooling control.
“Although they are not seen as traditional IT, they are also not built on a strong foundation.
“The exposure of our results as a society is very large and is increasingly exploited in cyber attacks as we saw in the recent disruption of the refrigeration unit in a supermarket in France.”
He warned that China is best placed to deploy AI to target Britain’s critical national infrastructure.