UK meat processing firms have been hit by cyber attacks after hackers targeted supermarket freezers across Europe. The National Cyber Security Centre said it had worked through the night to alert vulnerable British firms and warned of a real prospect of AI-boosted attacks on critical infrastructure in the next two years.
The NCSC said the national impact so far is "minimal". Paul Chichester, director of operations, told the launch of the NCSC's annual report: "We're aware of those incidents in the UK, and obviously we're working with the affected organisations. We'll keep monitoring that. At the moment, the impact is minimal."
The attacks come after hackers disrupted refrigeration units in supermarkets in France, where the attack involved legacy technology connected to the internet with default passwords. Dr Richard Horne, head of the NCSC, told the BBC Radio 4 Today programme that “handfuls of organisations” in the UK had been alerted and that the agency knew of “a couple of impacts”. Asked whether some freezers in the country had been switched to defrost, he said: “We don’t know the full impact, but we can see there are a couple of instances where vulnerable technology has been exploited.” He said it was too early to give a definitive answer on who was behind the attack.
Launching the annual report in central London, Dr Horne said teams had been “working through the night contacting organisations that we could see they had vulnerable technology exposed”. He warned that Britain was at risk because it had done “tech on the cheap” for decades, with end-of-life systems kept running and upgrades pushed back. The report warns that hackers demanding ransom payments are “highly likely” to use AI to target the UK by 2028, and that hostile states such as Russia and China will routinely use the technology by then. Dr Horne said China is best positioned to use AI against UK critical national infrastructure.
Dr Horne described the coming months as a “sliding doors” moment with a real prospect of an unprecedented rise in cyber incidents, not because AI had invented new ways to attack but because long-tolerated vulnerabilities could now be exploited at scale. He warned that if leaders did not act, they would one day have to explain why, “when food isn't on shelves, lights aren't on, businesses have gone under”.
The NCSC's incident management team received 1,831 reports of cyber attacks this year, of which 337 required support and 80 were nationally significant. The agency also warned 8,500 organisations that their systems had been compromised. Asked whether the attacks reinforced the Defence Secretary's warnings that people in the UK should stockpile, Dr Horne said: "Absolutely. And we saw criminal attacks last year impact retailers in the UK."
Separately, NSW Health in Australia was reported to have been hit by a cyber attack, according to The Sydney Morning Herald.
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.
Cyber incident reports received by the NCSC this year, by severity
reports
Covers the NCSC's reporting year to the launch of its annual report. Figures are nested: the 337 and 80 are subsets of the 1,831 reports received. Source: National Cyber Security Centre annual report
§
Analysis
Why This Matters
The attacks hit the food supply chain directly, with freezers switched to defrost and meat processors targeted, showing cyber incidents can have physical consequences for everyday goods.
The NCSC's warnings point to a coming wave of AI-enabled attacks on critical infrastructure such as power, water and manufacturing, not just IT systems.
Businesses and public agencies are being put on notice to replace weak, underinvested technology before it is exploited.
Background
The attacks on French supermarket fridges exploited legacy technology connected to the internet with default passwords, and the NCSC said it spent the night contacting British organisations with similarly exposed systems. The warnings came as the NCSC published its annual report, which argues that decades of underinvestment in technology have left critical infrastructure vulnerable and that AI will make these weaknesses far easier to exploit. The report also details a sharp rise in incident reports received by the agency over the past year.
Key Perspectives
NCSC Director of Operations Paul Chichester: says the impact on the UK is "minimal" so far and the agency is working with affected organisations.
NCSC Head Dr Richard Horne: says it is too early to identify who is behind the attacks, but warns that organisations that ignore the warning signs will have to explain themselves "when food isn't on shelves" and "lights aren't on".
NCSC annual report: says ransomware hackers are "highly likely" to use AI to target the UK by 2028 and identifies China as best positioned to use AI against UK critical infrastructure.
The Defence Secretary: has warned people in the UK should stockpile, a warning Dr Horne said he "absolutely" agreed with.
What to Watch
Whether further UK organisations report exploited vulnerabilities in the coming days as the NCSC continues to monitor the incidents.
Any announcement identifying the group or state behind the freezer attacks.
Whether UK businesses accelerate replacement of legacy and end-of-life systems in response to the NCSC's warnings.
12 claims in this story checked against 2 sources: 12 supported.
Show each claim
SupportedUK meat processing firms were hit by cyber attacks after hackers targeted supermarket freezers across Europe.The Independent UK: “Meat processing firms in the UK have been hit by cyber attacks after hackers targeted supermarket freezers across Europe.”
SupportedThe NCSC warned of AI-boosted attacks on critical infrastructure in the next two years.The Independent UK: “the NCSC warned Britain faces the prospect of AI-boosted attacks on critical national infrastructure in the next two years.”
SupportedThe NCSC said the national impact was “minimal”.The Independent UK: “The National Cyber Security Centre (NCSC) said it is working with the firms affected and that the national impact is “minimal”.”
SupportedThe report said hackers demanding ransom payments are “highly likely” to use AI to target the UK by 2028.The Independent UK: “Hackers demanding ransom payments are “highly likely” to use AI to target the UK by 2028”
SupportedPaul Chichester said: “We're aware of those incidents in the UK, and obviously we're working with the affected organisations. We'll keep monitoring that. At the moment, the impact is minimal.”The Independent UK: ““We’re aware of those incidents in the UK, and obviously we’re working with the affected organisations. We’ll keep monitoring that. “At the moment, the impact is minimal.””
SupportedNCSC teams worked through the night to alert British firms vulnerable to the attack.The Independent UK: “Head of the NCSC Dr Richard Horne said teams had been working throughout the night to alert British firms that are vulnerable to such an attack.”
SupportedThe French supermarket-fridge attack involved legacy technology connected to the internet with default passwords.The Independent UK: “It has emerged that the cyber attack on French supermarket fridges involved legacy technology connected to internet with default passwords.”
SupportedDr Horne said “handfuls of organisations” in the UK had been alerted and the agency was aware of “a couple of impacts”.The Independent UK: ““There are handfuls of organisations in the UK we’ve alerted and we’re aware of a couple of impacts.””
SupportedThe report said hostile states such as Russia and China would routinely use AI by 2028.The Independent UK: “hostile states such as Russia and China will routinely use the technology to pursue their goals by then, the report found.”
SupportedThe NCSC incident management team received 1,831 reports this year; 337 required support and 80 were nationally significant.The Independent UK: “The NCSC annual report said that its incident management team received 1,831 reports this year of cyber attacks, of which 337 required support and 80 were nationally significant.”
SupportedThe NCSC team warned 8,500 organisations that their systems had been compromised.The Independent UK: “The team also warned 8,500 organisations when their systems had been compromised by attackers, the report added.”
SupportedThe story says NSW Health was reported to have been hit by a cyber attack, according to the Sydney Morning Herald.Sydney Morning Herald - Latest News: “NSW Health hit by cyber attack.”
