Supermarket cyberattacks expose wider UK security gaps as AI threat grows

Cyberattacks targeting supermarket refrigeration systems across 10 European countries have forced retailers to discard large quantities of food, with the disruption also reaching the UK supply chain.

The attacks, which sent temperatures in some freezers soaring to 50°C, come as the UK’s National Cyber Security Centre (NCSC) warns that AI-powered malware is highly likely to be used against critical national infrastructure by 2028.

The incidents follow a similar attack on hundreds of French supermarkets three weeks earlier.

The BBC reported disruption in Belgium, Germany, Ireland, Italy, Sweden and other countries. In Belgium, dozens of stores suffered refrigeration failures, while 13 SuperValu outlets in Ireland were affected. Seven Intermarche stores in Portugal also reported incidents linked to an external refrigeration management provider.

The attacks have reached the UK food supply chain. Richard Horne, chief executive of the National Cyber Security Centre (NCSC), told BBC Radio 4’s Today programme that vulnerable technology had been exploited in a small number of cases.

“We don’t know the full impact, but we do know there are a couple of instances where vulnerable technology has been exploited and we’re working with those organisations,” he said.

The NCSC has been contacting businesses operating exposed systems and advising retailers to update their refrigeration control software. No group has claimed responsibility for the attacks.

AI could exploit existing weaknesses

The incidents coincide with the publication of the NCSC’s State of the Cyber Nation report and its assessment of AI-enabled cyber threats.

The agency considers it highly likely that AI-powered malware will be used in a ransomware attack against UK critical national infrastructure by 2028.

It also warns that hostile actors will increasingly use AI to identify weaknesses in older technology, accelerate attacks and exploit systems that organisations have failed to secure.

Speaking at the report’s launch, Horne warned that long-standing failures to invest in cyber security were becoming increasingly dangerous.

“Vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”

The NCSC examined three possible developments through 2028, ranging from a growing global cyber threat to a situation where offensive AI capabilities outpace UK defences. A more optimistic scenario envisages slower development allowing stronger countermeasures.

These are assessments of possible future threats, not predictions of specific attacks. There is no confirmed evidence that AI was involved in the supermarket incidents.

The government has announced £60 million for the first phase of a national Cyber Shield and £70 million for a new centre to identify vulnerabilities across critical infrastructure and the wider economy.

UK emergency services already face security gaps

The warning follows separate findings about weaknesses in the UK’s emergency services.

As Advance reported in October, an inspection by His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services found that police forces and fire services were poorly prepared for serious cyberattacks.

The investigation identified ageing IT infrastructure, weaknesses in password and access controls, inadequate testing of recovery arrangements and shortcomings in the oversight of technology suppliers.

The inspection also recorded 252 cyber incidents and 796 near misses between January and March 2026.

Although the findings concerned emergency services rather than food retailers, they highlighted similar challenges involving outdated technology, security responsibilities and the ability to maintain essential operations during an attack.

Experts warn of failures to act

Dr Asma Adnane, Senior Lecturer in Computer Science at Loughborough University, said the supermarket incidents raised questions about why known vulnerabilities had remained unaddressed.

“Following any cyber attack, the most important question is ‘was this vulnerability already on someone’s risk register?’”

She said vulnerabilities affecting refrigeration controllers in the earlier French attacks had reportedly been disclosed months before the incidents, with software updates already available.

“The incidents now affecting systems across several European countries appear to be using the same method, suggesting that even after the original attack made headlines, many operators still failed to act.”

Adnane said the increasing reliance on third-party companies to maintain essential equipment could leave businesses uncertain about who was responsible for security.

“This was not just a cyber security problem. It was a governance problem.”

She warned that organisations must treat the protection of operational technology as a business responsibility rather than leaving it entirely to IT departments.