British Association of Independent Meat Suppliers

Summary

The British Association of Independent Meat Suppliers reported that several of its more than 300 members were affected as collateral in a cyber intrusion targeting refrigeration controls, with one operator seeing cold units climb to 100 degrees Celsius and two others experiencing defrosting while the units were empty. A London produce wholesaler stopped the incident by disconnecting its cold storage from the internet, and another supplier intervened after attackers set units to defrost for over four hours at 150 degrees Celsius, preventing damage to stock. The affected systems used a control platform from a US software firm also linked to earlier supermarket incidents in France, and the vendor has recommended software fixes while working with customers. National cybersecurity authorities said they were assisting affected organizations and assessed the broader national impact as minimal, noting the attacks exploited long-known vulnerabilities and default credentials rather than artificial intelligence.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The United Kingdom’s National Cyber Security Centre said it was working with affected companies after hackers raised the temperatures of supermarket freezers across Europe, and that the national impact was minimal. Paul Chichester, the centre’s director of operations, made the remarks at the launch of the NCSC’s annual review, stating that the organisation was monitoring the situation and would keep working with affected organisations. Retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported problems with their refrigeration systems on Monday, with some temperatures rising to as high as 50C, and several companies confirmed they had been hacked. Similar incidents were reported in France the previous month, and the French attack involved legacy technology connected to the internet with default passwords. No UK grocery chain had been directly affected. The British Association of Independent Meat Suppliers said some of its more than 300 members had been affected after becoming collateral in the hack. One meat supply company saw its cold units rise to up to 100C while another two reported their units had started to defrost. The association said the affected units were empty at the time.

A fruit and vegetable wholesaler in London was also affected but prevented the attack from escalating by pulling the internet connection to its cold storage units out at the wall. Alex Pearce, managing director of Langridge Organic, said hackers had changed the parameters on a number of units, setting them to defrost for more than four hours at 150C. Pearce and his staff intervened before any stock could be damaged. Langridge uses the same fridge control system, developed by a US software company called Copeland, that was involved in the French supermarket incidents. Copeland said it is talking to affected customers and has recommended software fixes. Cybersecurity researchers said attacks on dummy Danfoss fridge controls, whose systems were also targeted in mainland Europe, displayed characteristics similar to recent operations linked to Russia. Xavier Bellekens, chief executive of Lupovis, recorded 256 attempted attacks from 91 different sources between 20 October and 30 October after setting up online honeypot traps indistinguishable from real Danfoss fridge controllers. Most authentication attempts used the manufacturer’s publicly documented factory-default username and password credentials, and the attackers used bulletproof hosting. Bellekens said there was overlap between infrastructure involved in the probing activity and infrastructure previously associated with Russian-linked malicious operations, though he could not pinpoint a group. The NCSC said the attacks were not AI-enabled and had used vulnerabilities that had been out there for a long period of time. The agency was working with organisations to identify loopholes in their technology and close them before hackers exploited them.

Sources

Sources available to members: 1 source.