British meat processing companies have been hit by the cyber attack that targeted supermarket fridges and freezers across Europe.
The National Cyber Security Centre (NCSC) confirmed today it was aware of the incidents, and that it is working with the affected organisations.
NCSC chief executive Richard Horne said its experts worked through the night to contact organisations in the UK that are identified to have vulnerable technology.
The Association of Independent Meat Suppliers (Aims), which represents 300 organisations, confirmed today that refrigerators in three abattoirs had been caught as “collateral damage” by the cyber attacks.
Tony Goodger, a spokesperson from Aims, said the fridges were empty at the time of the attacks and that no meat had been lost.
“Whoever these hackers are, they have targeted European supermarkets who are operating the same software, and some businesses in the UK are also using the same software, and they have been caught by the hack,” he told Computer Weekly.
Meat suppliers have been advised to ensure that controllers used in their refrigeration units are patched and not exposed externally to the internet.
Discontinued supervisory controllers
Copeland, a US supplier of refrigeration control units, said in a statement on its website that it was aware of a cyber security vulnerability affecting discontinued, end-of-life generation supervisory controllers.
“Protecting our customers’ operations remains a top priority, and we are working with impacted customers to help mitigate risk,” it said.
Cyber attacks this week hit retailers in Ireland, Belgium, Estonia, Finland, Luxembourg and the Netherlands, causing freezer units to fail, and making food unusable.
The British Retail Consortium, which represents supermarkets including Aldi, Asda and Iceland, said retailers were working with the NCSC.
“Retailers invest heavily in their cyber security and are currently working with the National Cyber Security Centre to ensure their fridges and freezers are secure as possible against potential attacks,” said Graham Wynn, assistant director of regulatory affairs at the British Retail Consortium.
More widespread attacks possible
The UK’s National Cyber Security Centre warned today that the attacks could be a precursor to more widespread assaults on internet-connected devices.
Horne suggested the breaches of refrigeration units represented “just the foothills” of what might come.
Earlier attacks against French supermarkets exploited retailers’ use of “legacy technology”, which had been connected to the internet, often with default passwords.
“There are so many vulnerabilities out there and you could say they are waiting to be exploited,” said Horne. “The most serious risk we face in the short term is just a huge rise in the volume of incidents we see.”
Businesses that run manufacturing lines, heating controls, building management systems and other operational technology (OT) devices could also be vulnerable to attack if their systems are not protected, the NCSC warned.
“There are a huge amount of OT devices connected to the internet, and all organisations need to be looking for them and addressing the connectivity and configuration of those devices,” said Horne.
AI will enable attackers to identify vulnerabilities in internet-connected controllers more quickly in the future, and could be used to reverse engineer the software used in OT devices.
Ollie Whitehouse, chief technology officer at the NCSC, said it was “quite clear” that adversaries were looking to use cyber attacks to impact the real world.
“The point we would labour with all organisations is: do you know what you have on the internet, and really question whether it needs to be there,” he said.
