UK food suppliers hit as fridge cyberattacks spread across Europe

Retailers now face a physical risk from hacked cooling controls, not just a data breach. Stock can be destroyed remotely, and nobody has said what the total losses are.

The incidents push a mundane piece of equipment, the internet-connected fridge controller, into the same regulatory conversation as payment systems and factory networks. Regulators are testing whether existing cyber rules and equipment approvals cover devices that were never designed to face the public internet. For shoppers, the visible effect is discarded food and thinner shelves. For suppliers, it is a cold chain that can be disrupted from a laptop. Neither the NCSC nor the European Commission has named a suspect.

UK suppliers pulled into a European fridge attack

British meat suppliers were caught in the fallout. The British Association of Independent Meat Suppliers said some of its more than 300 members had been affected after becoming "collateral" in the hack. No meat was lost, and the affected units were empty at the time, the association said.

The temperatures involved went far beyond anything a chiller should reach. One meat supply company saw its cold units rise to up to 100C while another two reported their units had started to defrost, according to the Guardian. A fruit and vegetable wholesaler in London stopped the attack from spreading by pulling the internet connection to its cold storage units out at the wall.

No UK grocery chain had been directly affected so far, the Guardian reported on 3 November.

What happened in stores

Ahold Delhaize said dozens of its Delhaize stores in Belgium and Luxembourg had a refrigeration incident on Monday, and that some food had to be discarded. The Dutch group told CNBC the situation had since returned to normal and the stores were fully operational.

Other Belgian chains reported narrower damage. Colruyt Group said five of its Spar stores were targeted. Carrefour said 15 of its Belgian stores were attacked. Intermarché said 15 of its 153 Belgian stores were hit, roughly a tenth of its estate there.

IKEA said a cyber incident affected fridges and freezers at its Mons store in Belgium between Sunday and Monday.

The wave was not confined to Belgium. ICA, Sweden's biggest grocery retailer, confirmed an incident at a limited number of stores that sat on networks outside its central systems. Kesko in Finland, Supervalu in Ireland and One Selver in Estonia also reported disruptions to refrigeration. Tom's Hardware reported on 2 November that hackers had raised temperatures to 50C in Belgium and Sweden and destroyed food stocks.

Intermarché said its security measures contained most of the attack, though a few stores suffered stock losses. It added that the bulk of the attack hit other players, notably Carrefour and Delhaize.

Why cold chains are exposed

The pattern is not new. In October, hundreds of French supermarkets were targeted in an attack that caused fires, overheated fridges and spoiled food. Les Mousquetaires, which owns Intermarché, told CNBC at the time that it expected damages of several million euros.

The refrigeration systems in the French attack used legacy technology connected to the internet with default passwords, the Guardian reported.

Paul Chichester, the NCSC's director of operations, said the attacks were not AI-enabled and had used vulnerabilities that had been "out there for a long period of time".

The NCSC's chief executive, Richard Horne, described the fridge attacks as the "foothills" of an enlarged cyberthreat facing companies and the public. Horne said AI systems were highlighting flaws in IT networks that owners were not aware of or had neglected to patch. Ollie Whitehouse, the NCSC's chief technology officer, said manufacturers needed to be encouraged to make their technology safer. Consumers, he said, needed to accept paying more for safer equipment. Alex Pearce, managing director of Langridge Organic, said the fix at his firm was simple. "It clearly must have been easy to get in [to the system] because the simple solution was to unplug ourselves from the internet," he said.

Regulators step in

The European Commission is in direct contact with national authorities. A spokesperson told CNBC that it had convened a meeting on the morning of 3 November of the EU interinstitutional Task Force, together with ENISA, Europol and the relevant Commission services.

The NCSC said it was working with organisations to identify loopholes and close them before hackers exploited them.

IKEA said it was continuing its investigation to determine exactly what happened.