EU task force meets after fridge hacks reach UK food suppliers

EU task force meets as UK suppliers report collateral damage

ENISA and Europol joined the task force. The Commission said it was in direct contact with national authorities.

The Hacker News reported the same day that a new wave of refrigeration cyberattacks had hit supermarkets across Europe and forced stores to pull food. In the UK, the National Cyber Security Centre said it was aware of "a couple of instances where vulnerable technology had been exploited". Paul Chichester, the NCSC's director of operations, said the national impact was minimal. He said the agency was working with the affected organisations. The British Association of Independent Meat Suppliers said some of its more than 300 members suffered as "collateral". Two saw fridges defrost. Another saw cold units rise to up to 100C. No UK grocery chain has directly suffered so far.

Why cold-chain attacks matter for food and regulators

Regulators are now coordinating across borders. Nobody has said who is behind the attacks or what the total damage is.

Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported refrigeration problems on Monday. Some stores reported temperatures as high as 50C. Ahold Delhaize said the attacks affected dozens of Delhaize stores in Belgium and Luxembourg, and it had to discard food. Intermarché said the attacks hit 15 of its 153 Belgian stores. It said a few suffered stock losses, though nothing comparable to the earlier French attack. Carrefour told the BBC that attackers hit 15 of its Belgian-based stores.

How the attackers got in

Sabcobel, a refrigeration contractor, manages systems for Delhaize. Its chief executive said attackers switched cooling units into defrost mode. The earlier attack on French supermarket fridges used legacy technology with default passwords and an internet connection. Chichester said the attacks did not use AI. He said they exploited vulnerabilities that had been "out there for a long period of time".

Alex Pearce, managing director of Langridge Organic, said hackers set units to defrost for more than four hours. His staff intervened before any stock suffered damage. Langridge uses the same fridge control system. US software company Copeland developed it, and it also featured in the wider incident. The same method appeared to be behind last month's incident that hit hundreds of French supermarkets.

October's French attacks set the pattern

Attackers targeted hundreds of French supermarkets in early October. The cyberattack caused fridges to overheat and food to spoil. Intermarché owner Les Mousquetaires told CNBC at the time that it expected damages of several million euros. Commissaries at six US military bases suffered freezer malfunctions in late August. The Pentagon is treating those as a suspected hack and coordinating with French authorities, Reuters reported.

What happens next

NCSC chief executive Richard Horne said it was still "too early to say" who was behind the hacks. Cybersecurity experts said attacks on "dummy" fridge controls showed characteristics similar to malicious operations that they link to Russia. Horne said organisations need to look at what they rely on and invest in renewal. He added that many firms had extended systems beyond their end of life. They had not kept them in secure compartments disconnected from the internet.