So, could Britain's food chain be hit by the cyber hackers targeting supermarket freezers all across Europe?

First there was melting ice-cream. Then the smell of rotting meat. And finally, the sight of desperate supermarket workers shovelling armfuls of spoiled food into black bin bags.On Sunday October 11, French supermarkets were hit by an unprecedented cyber attack on refrigeration units across 700 stores. In the worst-affected shops, freezer temperatures reached 80C, equivalent to a typical sauna, and small fires broke out as plastic and cardboard packaging ignited.Supermarket behemoth Cooperative U was among the worst hit, with about 5 per cent of its 2,000 stores affected. Other chains caught up in the attack included Carrefour, Intermarche, Monoprix and Netto. Food worth hundreds of millions of euros had to be discarded.The attack made global headlines, but it was only the beginning.For, just three weeks later, on Monday, a second cyber attack targeted refrigeration systems in about 100 stores across Europe, including in Sweden, Belgium, Ireland, Finland, Luxembourg and the Netherlands. Chilled and frozen food worth tens of millions of euros was ruined: in some cases it had been stored as low as minus 27C before the units were heated to more than 50C.EU agriculture and food commissioner Christophe Hansen described the second attack as a 'deliberate attempt to disrupt our food supply-chain'.The attacks across Europe led to shortages in supermarkets and empty shelves. Thankfully, the attacks did not affect refrigeration at the larger processing or storage facilities used by supermarkets, meaning retail shelves can be fully restocked promptly.However, the glaring shortages have done nothing to assuage concerns over supply chain readiness at the same time as European governments urge their citizens to stockpile for emergencies. Just last week Defence Secretary Wes Streeting told the British public to hoard enough supplies for 72 hours. Other countries have been even more draconian including Sweden whose authorities tell residents to be self-sufficient for up to a week. Freezers are emptied, and frozen goods are loaded into shopping carts to be thrown away at ICA Kvantum in Sjobo, Sweden after a hacker raised the temperature in the freezers But while supermarket shelves have for now returned to normal, it has since emerged that far from being a sophisticated hack along the lines of last week's multi-billion-pound cryptocurrency heist believed to have been orchestrated by North Korea, the recent attacks were made possible by 'basic security flaws' in computer software, according to the head of the French cyber security agency ANSSI, Vincent Strubel. Alarmingly, such flaws are thought to be widespread across Europe and Britain's 'operational technology': everyday items used by large businesses, including fridges and fire alarms, that are connected to the internet but are not prioritised for cyber-protection. AI has made exposing such security failings infinitely easier and quicker.No group has claimed responsibility for the recent attacks and no ransom has been sought, which appears to rule out criminal gangs. That being so, could these hacks be anything other than an unprecedented act of state-sponsored 'shadow warfare'?In its annual 'cyber security review', published yesterday, the National Cyber Security Centre (NCSC), part of GCHQ, warned: 'By 2028, it is highly likely China, Russia and other nation states will routinely use AI cyber to achieve their geopolitical goals, with the UK facing an increase in scale and speed of sophisticated cyber attacks.'This year alone, the NCSC has recorded at least 1,831 cyber-attacks on British companies, organisations or infrastructure, 80 of which were of 'national significance'.Yesterday it emerged that the UK's meat-processing industry is in the midst of one such attack and that teams from the NCSC had worked through the night to alert affected firms to the crisis.But how much do we really know about the recent attacks? And, crucially, could this be the start of a prolonged cyber campaign against Western Europe, including Britain? Like so much modern technology, supermarket refrigeration units are connected to the internet so that they can be controlled and monitored remotely, often by a single technician supervising multiple stores simultaneously.Getting access may have been easy. Many of these systems are believed to have been secured under 'default credentials': preset passwords such as 'admin' or '1234' that are listed in instruction manuals that can be freely downloaded online.'It's a preconfigured password,' explains Daniel Des Santos, vice president of research at cyber security firm Forescout. 'It's not a matter of guessing: they're publicly available.'Once inside, the hackers were able put the units into 'defrost' mode, rapidly increasing the temperatures. The hackers appear to have locked the supermarkets out of their own systems, with the head of one affected store in southern Sweden revealing: 'We can't adjust the temperatures... Hot air is blowing into the freezers. Everything is ruined.' A customer looks at an empty refrigerator at a SuperValu supermarket in Ireland, also hit by the cyber-attack Order was restored only once the refrigeration systems had been disconnected from the digital network and operated manually.'People traditionally think about laptops and smartphones being connected to the internet,' Dos Santos explains. 'But there are numerous other devices also connected, including refrigeration systems, door locks, fire alarms, security cameras – the list goes on. And ever since the war in Ukraine, we have noticed an increase in attacks against these sorts of devices.'It's not difficult to see why refrigeration units were an appealing target. Empty supermarket shelves impact on the public directly and are a glaring sign of supply-chain vulnerability. But perhaps more importantly, these systems were low-hanging fruit: as explained, the security on the units was often exceptionally poor.'This attack was enabled by very poor security design, not high-end exploitation,' James Lyne, CEO of leading cybersecurity organisation The SANS Institute told the Daily Mail. 'It is frankly a little embarrassing.'Why hadn't the passwords been changed? Likely, explains Dos Santos, because the systems were built decades ago, often without proper communication between the supermarket security team and the installer.As well as entering a default password to gain access to some systems 'through the front door', the hackers are believed to have identified vulnerabilities in computer code to access other systems.Until the start of this year, finding such vulnerabilities in software was 'very manual work', says Dos Santos. His team would spend 'hours, days and weeks' reading source code and finding flaws. Today, AI can do these tasks automatically.As Britain's NCSC chief executive Richard Horne explained yesterday: 'Vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.' Britain's cyber chief concluded that Britain had done 'tech on the cheap' for too long and that the country is increasingly vulnerable to AI-enabled cyber warfare.As for who precisely might have been responsible, this remains unknown – although there are several suspects.Gerome Billois, of cybersecurity and tech company Wavestone, says the attacks appeared 'designed to convey the message to populations that they are not safe, to convey the impression that the government is falling apart, and ultimately to instil fear. Currently there are two international actors known for doing this sort of thing: Iran and Russia.'But Ciaran Martin insists the mystery is only deepening: 'For the first time since I started heading up what became the NSCS 13 years ago, there's been a globally significant cybersecurity incident, and neither I nor anybody I know in the profession has a clue who's behind it.' A notice informing customers that refrigerators are temporarily out of service is displayed on an empty case at the Delhaize Shop & Go in Belgium One theory Martin does raise is that the hack could be an experiment ahead of further planned attacks. And when it comes to broader tech infrastructure across the UK, he is particularly concerned about healthcare.'The area that worries me most and most deserves national prioritisation is healthcare. Cyber attacks won't necessarily cause the power to fail in the middle of an operation, but if hospital administration can't process data properly, then hospitals will be forced to turn away ambulances. You cancel operations. You cancel diagnostic appointments.'Indeed, in the summer of 2024 Russian hackers attacked a number of British hospitals including London's King's College and Guy's and St Thomas' which led to the cancellation of operations and emergency patients being diverted to other healthcare centres.Martin adds that the most dangerous threat to any country – including the UK – is not some sort of 'cyber spectacular', for example taking out the entire national grid, but what the former head of the US Cyber Defence Agency Jen Easterly called: 'everything, everywhere, all at once'.Martin, who stepped down from NCSC in 2020, explains: 'Hundreds of low-level disruptive attacks that would seriously mess up the economy and society. Think what happened last year in the UK with Marks and Spencer and Jaguar Land Rover [JLR], and then multiply that by 100.'The Russian hack on JLR in August last year was widely acknowledged to be the most financially damaging in British history, costing just under £2billion and having a knock-on effect to 5,000 companies. The M&S hack in April last year led to empty shelves, a pause on online orders and the theft of customer data.But the recent sabotage of European refrigeration systems was different – and in some ways more ominous. For unlike JLR and M&S, the refrigeration attacks were not for profit, but to sow chaos and disorder. The target was not public money, but the public itself.Tomorrow it might not be the freezers but the train signals could fail, planes may lose direction in the sky, taps stop running, plug sockets lie dead, as a crisis happens everywhere, all at once.