Supermarkets in talks on cybersecurity as public urged to stockpile food

Defra bosses have told MPs they are increasingly worried the threat of cyberattacks on UK supermarket supply chains and have held talks with retail bosses to try to increase preparedness.

This week, ministers published new resilience advice to businesses and individuals, including calls for households to stockpile long shelf-life food.

It was billed as the start of a three-year campaign to help households across the UK feel better prepared for events such as severe weather and power outages, as the first named storm of the year, Storm Austen, hits the UK this week.

However, the chaos caused by the detection of a critical security flaw in the PHP web programming system, which caused dozens of government services and large numbers of private businesses to take down their websites over the past 48 hours, has thrown the spotlight firmly on cybersecurity .

In a speech yesterday at the opening of a tank gun barrel factory in the West Midlands, defence secretary Wes Streeting said he was urging businesses and households to step up preparedness for “increasingly sophisticated cyberattacks.”

“Are they prepared that there may be disruption to essential supply chains caused by hostile foreign state actors or terrorists?,” he said.

“How would we cope if the payment systems at the local supermarkets went down.”

“Those are the sort of everyday challenges we could well face.”

The government advice urges households to stock up with three days of food such as tinned meat , dried fruit and nuts , which doesn’t need refrigeration or cooking.

However, before the publication of the document and the events of the past two days, Defra had admitted fears were growing of cyberattacks on UK retailers.

Giving evidence to the Public Accounts Committee inquiry to examine the resilience of the UK’s food supply chain against catastrophic shocks last week, Defra permanent secretary Paul Kissack told MPs that the recent cyberattack on the fridges of French supermarkets had heightened existing worries in the department that the UK’s supermarkets were vulnerable targets.

“I worry a lot cyber,” Kissack told MPs.

“The reason I particularly worry cyber is that the risks are getting greater and the focus on critical national infrastructure is getting greater, as the chief exec of the National Cyber Security Centre has set out publicly.

“Aspects of the food system, from farm to fork, are connected to the internet to a degree that people are not necessarily au fait with. Who would have thought that French fridges would be the subject of a cyberattack? There are lots of areas that could be susceptible to that kind of attack.”

He added: “One of the characteristics that makes the food system as a whole quite different from some other critical national infrastructure systems is that it is very dispersed. Unlike the energy sector, which has a relatively small number of big critical assets, or the transport sector, where you can talk airports and so on, it is very dispersed; there are tens of thousands of firms out there. To some degree that is a vulnerability, because you would have to guarantee the cybersecurity of all those tens of thousands of firms.”

Earlier this month, The Grocer revealed Defra had brought together senior industry leaders to form a new Food Preparedness Group (FPG), co-ordinated by Kissack. It will investigate ways the industry can tackle the rising threat of cyberattacks on food companies and consider how to ensure vulnerable people get food in the event of major power outages.

Helen Dallas, interim deputy director for food preparedness and response at Defra, told the PAC committee Defra had learnt lessons from major cyberattacks on retailers. These include the crippling 2025 attacks on the Co-op and Marks & Spencer , as well as the Blue Yonder ransomware attack the year.

Dallas said: “The French supermarket attack is a really good example. When we heard that news, we quickly stepped up the National Cyber Security Centre and were in touch with our retailers and checking with our stakeholders to see whether there were any impacts.”

Helen Dickinson , chief executive at the British Retail Consortium, said this week’s cyber chaos was a major concern to retailers.

She said: “ This is a very serious incident. Many businesses continue to work closely with the National Cyber Security Centre to cyber threat intelligence and are continually reviewing their systems to ensure they are as secure as possible.

“Yet, when attacks do take place – both now and in the years to come – we ask customers for their patience and understanding while businesses work to address any issues.”

Government and Regulation