Cyberattacks targeting refrigeration units in European supermarkets have exposed significant security flaws in operational technology, raising concerns about the vulnerability of critical infrastructure, including Britain's food supply chain. The attacks, which began in October, saw temperatures in freezer units across hundreds of stores rise dramatically, leading to the spoilage of millions of euros worth of food.
Initially, French supermarkets experienced an unprecedented cyberattack affecting 700 stores, with some freezers reaching sauna-like temperatures. This was followed three weeks later by a second attack impacting around 100 stores across Sweden, Belgium, Ireland, Finland, Luxembourg, and the Netherlands. EU agriculture and food commissioner Christophe Hansen described the second incident as a 'deliberate attempt to disrupt our food supply-chain'.
While retail shelves were eventually restocked, the incidents have highlighted concerns about supply chain readiness, particularly as governments encourage citizens to stockpile emergency supplies. Experts suggest the attacks were enabled by basic security flaws, such as the use of default credentials like 'admin' or '1234' which are easily found online. These systems, often built decades ago, were not designed with robust cybersecurity in mind and are connected to the internet for remote monitoring and control.
Vincent Strubel, head of the French cybersecurity agency ANSSI, noted that such flaws are widespread across Europe and Britain's operational technology, including refrigerators and fire alarms. Artificial intelligence has made identifying and exploiting these vulnerabilities significantly easier and faster. Britain's National Cyber Security Centre (NCSC) has warned that by 2028, nation-states will likely use AI for cyberattacks to achieve geopolitical goals, with the UK facing an increase in sophistication and speed.
No group has claimed responsibility for the supermarket attacks, and no ransom demands have been made, leading to speculation about state-sponsored involvement. Experts like Gerome Billois suggest such attacks might be designed to instill fear and convey a message of insecurity. However, others, like Ciaran Martin, former head of the NCSC, admit a mystery surrounds the perpetrators of these globally significant incidents.
Beyond food supply, concerns are growing about the potential for similar attacks on other critical sectors, especially healthcare. Martin warned that while large-scale grid failures are less likely, hundreds of low-level disruptive attacks across various sectors could cripple the economy and society. He cited previous attacks on British hospitals, Marks & Spencer, and Jaguar Land Rover as examples of the cascading effects such disruptions can have. The refrigerator attacks are seen as particularly ominous because their motive appeared to be chaos and disorder rather than financial gain, targeting the public directly.