EU warns supermarket cyberattacks threaten food supply chain resilience

Supermarket attacks prompt calls for coordinated cyber resilience across Europe’s integrated supply chains

European authorities are examining the resilience of the food supply chain after cyberattacks hit dozens of supermarkets, with the EU warning that disruption to retailers can have consequences beyond individual businesses.

The recurrence of cyberattacks affecting dozens of supermarkets across Europe has prompted the European Commission to describe the incidents as a deliberate attempt to disrupt food supply chains and undermine consumer confidence.

EU Agriculture Commissioner Christophe Hansen said the attacks were “deeply concerning”, although he stressed that food security in the EU was not currently at risk. The incidents have nevertheless resulted in food waste and tangible impacts on affected businesses.

Boosting supply chain resilience

The warning highlights the growing importance of cyber resilience across interconnected supply chains. The incidents demonstrate how attacks against individual organisations can potentially create disruption far beyond their own technology estates, particularly where business operations rely on networks of retailers, wholesalers and logistics providers.

Hansen said food security depended not only on producing sufficient food but on ensuring supply chains remained resilient against “new and evolving threats”

European Commission staff met retailers affected by the October attacks - the second one of which only came to light around 36 hours ago - to assess the situation. The Commission is also seeking a broader picture of the preparedness plans retailers have established to deal with such incidents. Hansen said he would raise the issue with fellow commissioners at the next meeting of the EU College.

The development brings questions around cyber preparedness and operational resilience into sharper focus for organisations responsible for critical supply chains. Businesses increasingly need to consider disruption across the wider ecosystem on which their operations depend, rather than treating cyber risk as an internal IT issue or a cost centre.

Hansen called for a coordinated approach spanning wholesalers, logistics operators and retailers, arguing that every part of the food supply chain needs to be capable of withstanding and responding to cyber threats.

AI enables weakness exploitation at scale

The European concerns also underline warnings set out today by Richard Horne, chief executive of the UK’s National Cyber Security Centre (NCSC), about the consequences of failing to invest in cyber resilience. Its State of the Cyber Nation report warns that AI-powered malware is highly likely to feature in a ransomware attack on UK critical national infrastructure by 2028.

In remarks released ahead of the report’s launch, Horne argues that the immediate danger is not AI inventing entirely new attacks but enabling adversaries to discover and exploit longstanding weaknesses at unprecedented scale. The NCSC expects hostile actors’ adoption of AI to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation over the next two years.

Horne’s call for action focuses on addressing underinvestment, avoiding unnecessary internet connections and treating Cyber Essentials as a starting point rather than an endpoint. He also identifies AI as an opportunity to strengthen collective cyber resilience, provided organisations address their underlying technology weaknesses.

Both the UK and EU emphasise that resilience cannot stop at an organisation’s boundary. Keeping goods we all rely on moving requires investment and coordination across multiple businesses and systems.