The UK's cyber security centre moved to reassure businesses on Tuesday after meat suppliers in the UK were hit by cyber-attacks that followed hackers raising the temperatures of supermarket freezers across Europe. The National Cyber Security Centre (NCSC) said it was working with the affected companies but the national impact was minimal.

Paul Chichester, the NCSC's director of operations, said on Tuesday at the agency's annual review launch that the UK impact was minimal at the time. "We're aware of those incidents in the UK, and obviously we're working with the affected organisations. We'll keep monitoring that," he said.

What happened across Europe

Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems with their refrigeration systems on Monday, with some units rising to 50C (122F). Several companies confirmed they had been hacked, and similar incidents were reported in France the previous month.

The French supermarket fridge attack involved legacy technology connected to the internet with default passwords left unchanged. That weakness has been central to understanding how the wider refrigeration hacking campaign worked.

UK suppliers caught as collateral

The British Association of Independent Meat Suppliers said some of its more than 300 members had been affected after becoming 'collateral' in the hack. The association said no meat had been lost, but the incidents reminded the food industry that businesses across the supply chain may be seen by some as targets.

The scale of the disruption varied. One UK supply company saw its cold units rise to up to 100C (212F) while another two reported their units had started to defrost; the affected units were empty. The Grocer reported that a fruit and vegetable wholesaler in London had been affected but did not lose any stock.

Chichester said the NCSC was working with organisations to identify loopholes in their technology and close them before hackers exploited them. No UK grocery chain has been directly affected so far.

Who is behind the attacks

Researchers said attacks on dummy Danfoss fridge controls, which were targeted by the hackers in mainland Europe, were similar to recent operations linked to Russia. Lupovis, a security firm, recorded 256 attempted attacks from 91 different sources between 20 October and 30 October using honeypot Danfoss controllers, according to chief executive Xavier Bellekens.

Most of the authentication attempts used the manufacturer's publicly documented factory-default username and password credentials, the firm found. The attackers were using internet service providers that are particularly tolerant of malicious activity and often ignore abuse complaints, in a practice known as 'bulletproof' hosting.

"What caught our attention was the overlap between infrastructure involved in the recent probing activity and infrastructure we have previously associated with Russian-linked malicious operations," Bellekens said. While no group could be pinpointed, he said the number of actors that fit this bill is relatively small, and the same bulletproof hosting had been used by Russian groups earlier.

Chichester said the NCSC could not say who carried out the attacks, but that they were not AI-enabled and had used vulnerabilities that had been out there for a long period of time.

NCSC warning on wider cyberthreat

NCSC chief executive Richard Horne said the fridge attacks represented the 'foothills' of an enlarged cyberthreat, as artificial intelligence highlights unpatched IT flaws. "There are so many vulnerabilities out there that … you could say are waiting to be exploited," he said.

Ollie Whitehouse, the NCSC's chief technology officer, said domestic internet-connected devices could be hacked and that manufacturers needed to be encouraged to make their technology safer. Consumers, he added, needed to accept paying more for safer equipment.

The NCSC said it would keep monitoring the UK incidents and was helping organisations identify and close technology loopholes before hackers exploited them; no UK grocery chain had been directly affected so far.