Britain On Alert as Hackers Shut Down Supermarket Fridges Across Europe

Cyber attacks on 70 stores across the Continent spark food security fears

Britain’s cyber security chiefs have issued an alert to retailers after European officials said the hacking of supermarket fridges was a threat to food security.

The National Cyber Security Centre (NCSC), part of the GCHQ spy agency, said it was working with retailers to guard against the digital threat following attacks that caused widespread damage.

On Monday, it emerged that dozens of shops in Belgium, Sweden, Ireland, Luxembourg and Estonia had been targeted, just weeks after hundreds of grocery stores in France were hit. Ikea, the Swedish furniture chain, was among those affected.

The attacks have seen large amounts of food spoil after hackers gained remote access to in-store fridge units and turned up their temperatures, in some cases to as much as 80C.

The UK Government has urged households to stockpile enough essential supplies to survive for three days amid the growing threat from emergencies such as cyber attacks.

Wes Streeting, the Defence Secretary, said potential scenarios included power cuts or situations when “your local shop is subject to a cyber nattack”.

It is understood that no British supermarkets have been affected by the hacks – but there are concerns that major chains, including Tesco and Sainsbury’s, rely on similar equipment.

Industry sources said the NCSC had issued advice to retailers and was in touch with bosses to ensure that they were patching any vulnerabilities.

An NCSC spokesman told The Telegraph: “The NCSC is working with its international partners and industry to fully understand details of an incident.”

Richard Horne, the head of the NCSC, will warn companies on Tuesday that they need to “invest with urgency” and can no longer get away with doing “tech on the cheap”.

Mr Horne will warn that AI is likely to be used to carry out a ransomware attack on Britain’s critical infrastructure in the next two years, and that organisations have spent years saving money instead of shoring up their cyber defences.

He is expected to link under-investment in cyber security to the attacks on fridges, saying: “For decades we have collectively got away with tech on the cheap.

“Our resulting exposure as a society is huge and increasingly exploited in cyber attacks, as we saw in the recent disruption of refrigeration units in supermarkets in France.”

No group or individual has publicly claimed responsibility for the hacks across Europe on Monday. However, the attacks have heightened concerns about the risk to critical infrastructure from cyber criminals and state-sponsored hackers.

Christophe Hansen, the EU commissioner for agriculture, said the “deeply concerning” incidents amounted to “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”.

Tom Hegel, a researcher at SentinelOne, a cyber security firm, told Reuters that the absence of any financial demands probably pointed to sabotage, but that the attack would be difficult to trace.

He said: “An attacker who logs into an exposed control panel leaves almost nothing behind. A teenager and an intelligence service would look much the same from ⁠the defender’s side.”

Osavul, a security company, predicted last week that Russia could attempt a “destructive cyber attack” on European energy or heating systems this winter.

It pointed to suspicions that Moscow was behind plots to bomb a Polish railway, smuggle an explosive drone into a German airport and burn down the warehouse of an Estonian defence company.

Russian hackers have also been linked to a cyber attack on Jaguar Land Rover last year that shut down the British carmaker’s production lines and caused £2bn worth of damage.

Moscow has repeatedly denied any ‌involvement in sabotage.

Katrien Eggers, a spokesman for Belgium’s Centre for Cybersecurity, said of Monday’s hacks: “It is not known who is behind this attack, and it may never be determined.”

She warned that widespread use of artificial intelligence software meant such hacks were now becoming easier for anyone to carry out, especially “sophisticated actors”.

The supermarket hacks have rung alarm bells about food security across the continent, as experts warn that internet-connected devices ranging from domestic appliances to industrial machines are vulnerable to cyber attacks – some of them state-sponsored.

Dozens of grocery shops in Belgium, Sweden, Ireland, Luxembourg and Estonia were targeted on Monday, causing at least €100,000 (£88,000) in food losses. One shop manager in Sweden said temperatures in his fridges had been turned up to 55C.

The hacks in France affected fridges supplied by Danish engineering giant Danfoss, which is also a supplier to British chains including Tesco and Sainsbury’s.

At least two of the supermarkets reporting issues on Monday – Swedish chains Ica Supermarket and Stora Coop – also appear to be Danfoss customers.

In response to the hacks, Danfoss has claimed that most of the affected French fridges were either legacy systems or newer ones running on outdated software.

Danfoss claims to have issued software updates for the devices that should protect them from the digital vulnerabilities exploited by the hackers.

At the time of the French hack last month, the company told trade news website Cooling Post: “We are working with affected customers to implement appropriate mitigation measures, including firmware updates where available, stronger network protections and removing direct internet exposure where applicable.”

A spokesman for the British Retail Consortium also confirmed that it had been liaising with domestic retailers about the incidents in Europe.

Graham Wynn, of the BRC, said: “Retailers invest heavily in their cyber security and are currently working with the National Cyber Security Centre to ensure their fridges and freezers are secure as possible against potential attacks.”

Rickard Nilsson, the manager of an Ica shop in Sjöbo, Sweden, told the newspaper Aftonbladet: “We can’t adjust the temperatures, we can’t change them. Hot air is blowing into the freezers. Everything is ruined.”

In Belgium, 40 Delhaize supermarkets were affected after fridge temperatures were set to as high as 70C, along with 15 Carrefour shops and five Spar stores.

A Delhaize spokesman said: “We have identified an IT incident affecting the refrigeration systems in several dozen stores. We immediately took the necessary measures to keep our stores operational.”

In Ireland, refrigerators at 13 SuperValu stores were targeted meaning fresh produce had to be thrown away.

A major Estonian supermarket chain was also hit, according to the country’s national broadcaster.

Camilla Nilsson, the store manager of Ica St Olof in Österlen, Sweden, said the hackers “managed to get into our refrigeration management systems and change the settings”. At least four of the supermarket chain’s stores were hit.

The cyber attacks on the supermarkets involved the same mechanism as the French attacks, Stephan Moelans, the chief executive of the refrigeration installer Sabcobel, said.

The attackers remotely switched the systems’ evaporators to defrost mode, causing the refrigerators to heat up, he said.

Cyber criminals carried out the attack between Sunday night and Monday morning.

Source: www.telegraph.co.uk