UK food supply chain at risk from hostile attacks

A UK watchdog is warning that cyber criminals making moves against online systems in the food supply chain could cause serious upset, following damaging attacks on the Co-op and Marks & Spencer last year. The National Audit Office (NAO) named cyber-attacks as one of the major threats to the food supply chain and said the Department for Environment, Food & Rural Affairs (Defra) should work closely with industry to help prevent severe shocks. “Recent disruptions have shown the resilience of the UK’s food supply chain, but risks are increasing in likelihood and severity. Defra should learn from approaches taken in other countries, and strengthen preparedness for emergencies by testing plans with local government and industry,” said Gareth Davies, head of the NAO. In its report published late last week, the NAO said the sector had shown some resilience to cyber-attacks, but the government needed to work with the sector to help mitigate their impact. The report found businesses in the food supply chain have faced increased costs and, in some cases, disruptions to day-to-day operations, for example following 2025 cyber-attacks on retailers such as Marks & Spencer and the Co-op. Leading UK retailer Marks & Spencer estimated the cyberattack that took place in April last year will cost it around £136 million ($177.2 million) in total. The retailer said one of the earliest actions it took in its incident response was to disconnect its warehouse management systems, which in turn meant online and in-store orders were adversely impacted. Food retailer the Co-op confirmed that thieves stole data from 6.5 million of the organization's members during a cyberattack last year. In its report, the NAO said: “The way the food supply chain has developed over time has prioritized efficiency, which reduces costs for businesses, and therefore for consumers. However, it leaves the supply chain more vulnerable to disruptions. Defra and food supply chain stakeholders see risks increasing, and businesses are investing to address growing risks such as increased threats of cyber-attacks. Defra is less confident about the ability of businesses to withstand shocks without government intervention in the next five to 10 years because of increasing risks and the potential for more severe disruptions.” The NAO found cyber-attacks were among the disruptions that had increased operating costs for businesses and disrupted day-to-day operations, affecting their core digital systems. Several food supply chain organizations cited the substantial investments businesses are making to manage the threat and incidence of cyber-attacks. However, some said overall economic pressure on businesses is making this and other resilience investments more difficult, the NAO added. Defra said it undertook specific food-related exercises which, since 2023, have focused on testing responses to a cyber incident affecting the food sector. However, the government department may not be best placed to offer tech advice. In 2023, it admitted two-thirds of its interactions with its 21 million customers still require paper-based forms, after decades of digital government initiatives. Meanwhile, 30 percent of its applications were out of support. ®