Businesses must urgently strengthen their cyber defences or face major disruption, Britain’s head of cyber security has warned after supermarkets across Europe were victims of hacking.
Richard Horne, head of the UK's National Cyber Security Centre, said organisations were relying on outdated technology that was increasingly vulnerable to cyber attacks, while artificial intelligence was giving hostile states and criminals new ways to identify and exploit weaknesses.
Mr Horne warned in the NCSC's annual report today that the risk is “not because AI has invented new ways to attack us”, but “because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable”.
A wave of cyberattacks on Monday targeted supermarket freezers across Europe, with temperatures boosted as high as 50°C, forcing stores to throw away huge amounts of spoiled food.
The NCSC chief executive, whose organisation is attached to the cyber intelligence agency GCHQ, condemned decades of underinvestment in “operational technology”. This refers to systems that control electricity networks, water supplies, switches and refrigeration units, which collectively represent a “load of vulnerabilities” in Britain.
“Technology underpins everything” in modern society but there is “so much vulnerability in the technology we rely on because it's been underinvested in”, he told the BBC before a keynote speech on Tuesday.
Mr Horne warned that many organisations had extended equipment beyond its intended lifespan, failing to upgrade systems or properly isolate them from the internet.
“They've not kept them upgraded. They've not kept them in secure compartments, disconnected from the internet, and that leaves a whole load of vulnerabilities.” He said that AI “in the hands of our adversaries” can exploit those vulnerabilities.
Monday's cyberattacks affected supermarkets in Belgium and Luxembourg as well as Sweden, Ireland, the Netherlands, Estonia and Finland. The events followed attacks targeting supermarkets and food suppliers in France in early October.
Asked if Russia or Iran might be behind the attacks and why they would want to defrost supermarket freezers, Mr Horne said the motive behind the incidents remained unclear.
“At this stage, we just don't know. It might be states. It might be criminals,” he said. He said there had been some instances in the UK as well as in Europe.
He called on companies to make technology renewal a priority and advised households to keep devices updated, enable automatic updates, maintain offline backups and use passkeys wherever possible.
While the NCSC provided warnings and intervened where possible, the ultimate responsibility for protecting systems was with individual organisations.
“We work 24-7. We alert people. We intervene where we can. But at the end of the day, it's your business. It's your life. You need to make the choice and choose wisely,” Mr Horne said.
