The head of National Cyber Security Centre says the UK has been caught up in a cyber attack by hackers who targeted fridges in European supermarkets on Monday
Dozens of supermarkets across Europe were hit by a cyber attack on fridges on Monday (Image: Damien Eagers/Press Association)
UK firms have hit by the same cyber attack that allowed hackers to overheat supermarket fridges in Europe, a top security chief has revealed.
Richard Horne, chief executive officer of the National Cyber Security Centre, which is part of GCHQ, warned the threat was not just to supermarkets, but through the whole food supply chain.
He said: “We have been working through the night alerting organisations where we can see they’ve got exposed technology that is vulnerable in this way.
“There are handfuls of organisations in the the UK we’ve alerted and we’re aware of a couple of impacts, we think. We don’t know the full impact but can see there are a couple of incidents where vulnerable technology has been exploited and we have working with those organisations to understand more.”
Mystery still surrounds who was responsible for Monday’s attack, which impacted dozens supermarkets in seven countries across Europe. But hackers were able to remotely crank up the temperatures of in-store chillers to as high as 55C, leading millions of euros worth of ruined food. It is the second time in recent weeks that retailers’ fridges have been targeted, raising concerns about gaps in their security.
Asked on BBC Radio 4’s Today programme who might be behind the attacks, Dr Horne said: “It’s too early for use to say. At this stage we just don’t know. It might be states, it might be criminals. It is a genuine unknown at this stage. They all have different motivations.”
Dr Horne said the incident was a timely warning of the ever-present threat from cyber attackers, made worse by the rapid development of AI. He said that while the latest incident involved supermarkets, all businesses households rely could be in danger, right down to the local corner shop.
“The fact is technology underpins everything we rely on in our everyday lives,” he said. “It is not just IT but operational technology that controls physical things, like electricity switching, water, and refrigeration units. And that technology base that we rely on as a society has not been invested in the way to the extend it should have been.
“Many organisations have sweated their assets, have extended use of systems beyond their end of life and not kept them upgraded. And that leaves a whole load of vulnerabilities that now AI, in the hands of our adversaries, can enable them to find with ease and exploit.
Dr Horne said “there are vulnerabilities in all sorts of technologies, keeping our lights, keeping our water running, keeping food on the shelves, they all rely on technology to be there, to be operating correctly and on much of that technology there is vulnerability that shouldn’t be there and we need all organisations to invest in renewing their technology.”
He earlier warned Britain was facing a moment of “enormous consequence” for national cyber security akin to the plot of the film Sliding Door, as the NCSC’s annual report suggested the country was in danger of an AI-boosted attacks on critical national infrastructure within the next two years.
Hackers demanding ransom payments are “highly likely” to use AI to target the UK by 2028 and hostile states such as Russia and China will routinely use the technology to pursue their goals by then, the NCSC annual report found.
In a speech launching the report, Dr Horne will say: “It is clear that our nation is living through a moment that, in hindsight, we will see as one of enormous consequence. “A `sliding doors’ moment. A moment of choice.
“In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”
He went on: “When food isn’t on shelves, lights aren’t on, businesses have gone under, we may have to explain that we saw the warning signs, understood the risks and still didn’t make the right choices.”
The NCSC annual report said that, this year, its incident management team received 1,831 reports of cyber attacks, of which 337 required support and 80 were nationally significant. The team also warned 8,500 organisations when their systems had been compromised by attackers, the report said.
