Supermarket fridge attack is just the start, says UK cybersecurity chief

By Michael Holden

LONDON, Nov 3 (Reuters) - A cyberattack on supermarket fridges across Europe is just an early sign of what are likely to be increasingly frequent disruptions as old technology fails to keep pace with hackers, Britain's cybersecurity chief said on Tuesday.

On Monday, fridges and freezers in supermarkets from Sweden to Belgium and France were hit by hacking attacks which exposed vulnerabilities in IT systems, leading to stores having to throw away large amounts of food.

Richard Horne, head of Britain's National Cyber Security Centre, which is part of the GCHQ spy agency, said the incident was "just the foothills, as it were".

"There are so many vulnerabilities out there that in some ways you could say are waiting to be exploited," he said following a speech to coincide with the release of his agency's annual report. "The most serious risk we face in the short term is just a huge rise in the volume of incidents."

The NCSC's annual report says artificial intelligence is expected to enhance the capabilities of hackers in coming years. NCSC officials have said that in the case of the refrigerator attacks advanced AI probably would not have been needed, as the attacks targeted known vulnerabilities in old tech.

But Horne said AI will make it increasingly easy to find such old vulnerabilities, and exploit them on a huge scale.

"We must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable," Horne said.

'TECH ON THE CHEAP'

Too many organisations and supply chains in Britain had got away with "doing tech on the cheap" for decades, which had left them vulnerable, Horne said.

"When food isn't on shelves, when lights aren't on, businesses have gone under, we may have to explain that we saw the warning signs, understood the risks and still didn't make the right choices."

In its annual report, the NCSC said it was highly likely there would be  a ransomware cyberattack involving AI-powered malware by 2028 on Britain's critical infrastructure.

Horne said Russia was making sustained attempts to penetrate UK military networks, while Iran was carrying out malicious cyber operations globally, including against the UK.

"We know that China highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets with their activity representing the most sophisticated and sustained cyber challenge the UK faces," he said.

Moscow, Beijing and Tehran have all repeatedly denied similar accusations of malevolent cyber actions in the past.

(Reporting by Michael Holden; Editing by Alison Williams and Peter Graff)