European cyber attacks: Overview
- Cyberattacks are making food infrastructure a geopolitical target
- Refrigeration systems are increasingly being hit to cause disruption and food waste
- One attack can trigger supply chain chaos across multiple businesses
- Outdated software and weak remote access leave manufacturers exposed
- Experts say stronger controls and verification are now essential for food security
Two catastrophic cyberattacks on European supermarkets in recent weeks have raised concerns that food and drink could now be at the epicentre of a new geopolitical battleground.
No one has claimed responsibility and while experts are divided on the culprit behind the latest disruption this week, it is widely agreed that state actors – namely Russia, China, Iran and North Korea – are increasingly hitting critical infrastructure in the West made vulnerable by poor IT security and outdated software.
Food fridges first emerged as the targets of cyber attacks in 2022 when Russian and Israeli shops were hit. Now though, it seems their frequency is escalating. So far this year, ransomware gangs have targeted over 310 food and beverage companies with attacks, according to Comparitech, with the security company Forescout attributing many to pro-Russian groups.
“I think we need to look beyond the supermarkets themselves and consider what these attacks are actually trying to achieve,” says Tim Williams, CEO at consultancy firm Quod Orbis.
“This isn’t necessarily about financial gain or stealing data. It is about disruption, and the ability to disrupt something society relies on every single day: the supply of food.”
The attacks across Europe this week crippled dozens of supermarkets yet notably came without any extortive demands. Perhaps this was inevitable – the threat was already carried out by overheating the fridges.
But for Annabel Kyle, head of safety compliance services at Food Alert, it suggests a particular kind of motive. “These attacks seem focused on disrupting critical infrastructure, undermining countries’ already fragile food security, and weakening public confidence in the food supply chain,” she says.
A ripple effect
In many ways, supermarkets are an obvious target for anyone wanting to disrupt society. They are an integral part of most people’s everyday lives with mass disruption almost certain to covet mass media coverage and sow worry and chaos.
But it is not just the direct victims feeling the effects. The fine margins that food runs on – both commercially and logistically – means one attack can quickly ripple through numerous, unrelated businesses and countries in one fell swoop. Small suppliers don’t get paid. Farmers lose perishable goods.
“While the businesses attacked are the immediate victims, both financially and reputationally, the tendrils of these attacks reach much wider,” says Kyle. “The supply chain is thrown into chaos, affecting the food security of the nations and regions involved and, ultimately, leaving the end consumer questioning how they will put food on the table.”
Direct threat
Food and drink companies are also coming under direct threat. In the UK this week, several meat suppliers reported attacks on their refrigeration units while Langridge Organic, an organic fruit and veg wholesaler, said cyber attackers seized control of six of its ten cold-rooms systems.
For these types of businesses, the consequences can be dire as just a few hours of downtime can upend production, spoil inventory and ultimately leave supermarket shelves empty. Unlike many other services, manufacturers can’t simply restore a server and recover lost time.
What makes it easier for the attackers is that many manufacturers rely on the same technology, configurations and third-party contractors across hundreds of locations, enabling attacks to be carried out on a mass scale. An attacker doesn’t need to break into 100 different sites, but must only exploit one vulnerability or poorly secured remote connection to affect all 100.
Iain Davidson, head of product marketing at Wireless Logic, says food businesses are too often reliant on the ageing technology of many refrigeration units running outdated software without regular security updates.
“Poorly secured connections give attackers a way in. Once inside, they can issue new commands remotely, such as raising default temperatures to deliberately ruin food stocks, as we have seen in the recent wave of attacks,” he explains.
It’s clear now that these cyber attacks on food businesses are no longer a one-off incident. “It is a method that works, and attackers will keep using it until it stops working,” says Patrick Lamplmair, CTO and co-founder at Tributech.
“Why this route? It is cheap and the damage is immediate,” he adds. “There is no data to steal and no ransom to negotiate. A few commands to a temperature controller destroys stock overnight and closes stores.”
Immediate action is needed
So what can manufacturers do to protect themselves? The first step is recognising that cyber attacks are a question of when, not if, says Dai Vaughan, chief technology officer at digital transformation consultancy Public Digital and co-founder of the UK Government Digital Service.
This means the priority shouldn’t just be keeping cyber attackers out, but stopping an attack on one piece of equipment spreading to others, he explains.
“If a hacker gets into one freezer, they shouldn’t automatically be able to access every freezer. Businesses need to have safeguards in place to limit the damage, keep essential services running and recover quickly.
“Cybersecurity can no longer be just about protecting computers and data. It’s now about protecting the everyday equipment that keeps businesses’ doors open.”
Lamplmair agrees, noting the ultimate fix must be to reduce trust and boost verification. This means every command a fridge gets should have to prove where it came from. There should also be limits on the kind of instruction it can receive. “A freezer should never accept an instruction to heat to 50°C, no matter who sends it,” he says.
Kumar Sokka, CEO of security firm Acre Security, says food manufacturers must finally start treating refrigeration and building systems as part of the security perimeter, not as facilities maintenance. That means treating it like any other route into the business with named users, limited access and a record of who did what, he says.
“None of this is exotic. It’s the discipline most organisations already apply to IT, extended to the physical systems food and drink run on.”
