Weaponising our food supply: the dark new age of cyberterrorism

For decades, the food industry has invested heavily in protecting consumers from biological, chemical and physical hazards. Sophisticated food safety systems, stringent regulations and extensive monitoring programmes have been established to identify threats before they reach our dinner tables. But I fear it is now time to address an emerging vulnerability that could undermine these safeguards: cyberterrorism.

When I wrote my article Cold Chains, Red-Hot Risks: The Critical Infrastructure Not Talked About Enough just a few months ago highlighting the vulnerabilities of our cold chain infrastructure to cyberattacks, I certainly did not expect the weaknesses I had warned about to be exposed so quickly or on such an alarming scale. The recent cyberattack targeting refrigeration systems in French supermarkets serves as a ‘chilling’ reminder of these vulnerabilities. Hackers reportedly interfered with digitally controlled refrigeration equipment, causing substantial losses of perishable food. If cyberattacks can interfere with supermarket refrigeration, could they inflict even more damage in the food system? I put my food safety lens on and began to consider what other critical vulnerabilities might be lurking beneath the surface, largely overlooked yet often hiding in plain sight.

What’s important here is that cyberterrorists don’t need to contaminate milk but undermining confidence in the systems proving its safety could itself trigger a major crisis.”

When food safety becomes a digital vulnerability

Modern food manufacturing relies heavily on interconnected technologies, including automated production systems, electronic monitoring and remote maintenance platforms. These systems improve efficiency, reduce waste and enhance traceability. But I believe they also create vulnerabilities to attack from bad cyber actors. These cyberterrorists, as I prefer to call them, could range from disaffected youngsters with chips in their computers and on their shoulders, bad acne and little appreciation of the real-world harm they cause, to sophisticated, state-sponsored cyber gangs intent on disrupting everyday life and destroying public trust in the institutions meant to protect us. The UK’s National Cyber Security Centre (NCSC) recognises that attacks on operational technology can have direct physical consequences, making the task of protecting these systems fundamentally different from conventional IT security.

Five potential vulnerabilities that concern me

I have been thinking about milk pasteurisation, an essential safeguard in dairy production. The process relies on carefully controlled temperatures and treatment times to eliminate dangerous microorganisms. Modern dairies use automated systems to monitor these critical parameters. If processing controls or monitoring records were compromised, inadequate treatment could allow pathogens to survive and potentially cause serious harm or at least pose the threat of harm. A major dairy unable to demonstrate that its systems had not been compromised might face extensive recalls, interrupted milk collections and supermarket shortages, potentially affecting millions of consumers. Importantly, cyberterrorists would not need to contaminate milk: undermining confidence in the systems used to verify its safety could itself trigger a major crisis. Hostile cyber actors claiming to have hacked into milk pasteurisation may be enough to trigger an immediate loss of trust in consumers that their milk is safe.

Commercial sterilisation presents another serious potential vulnerability. Canned foods depend on validated thermal processes to control microorganisms capable of surviving during storage. For low-acid canned foods such as vegetables, meats and fish, Clostridium botulinum, associated with potentially fatal botulism, is a particular concern. If automated sterilisation controls were compromised and independent safeguards failed, products might receive inadequate treatment without the problem being recognised. Because canned foods can remain in circulation for years, the consequences could extend across national and international markets, leading to extensive recalls, potentially severe public health impacts and a widespread loss of trust.

My third concern is the widespread use of automated systems to measure and add ingredients during food manufacturing, a process that could become a serious vulnerability if deliberately disrupted. Modern factories rely heavily on computer-controlled recipes, ingredient dispensing and electronic labelling. Interference with these systems could lead to incorrect ingredient quantities or discrepancies between product contents and labels. For someone with a severe food allergy, even small amounts of an undeclared allergen can trigger a life-threatening reaction. A single compromised system supplying multiple brands could affect numerous products. Again, the potential for a large-scale food scare is clear.

Water treatment and sanitation systems are my fourth area of concern. Water is essential for food processing, cleaning and hygiene, yet treatment and cleaning-in-place operations are increasingly automated. Cyber interference could compromise sanitation cycles, disrupt water treatment or undermine records demonstrating that equipment had been cleaned correctly. The consequences could include microbiological contamination, production shutdowns and substantial food losses. Even the suspicion that food safety systems had been deliberately compromised could trigger widespread consumer anxiety, costly product recalls and a profound loss of public trust in the safety of our food supply.

My final concern, and perhaps the greatest national food safety threat, involves digital logistics and traceability systems. Food manufacturers, warehouses, distribution centres, retailers and foodservice operators increasingly depend on electronic inventory management, automated ordering, transport scheduling and batch identification. A major cyberattack could prevent perfectly safe food from reaching consumers, causing empty shelves and substantial waste. This also poses a serious food safety risk. If traceability records were corrupted or inaccessible, manufacturers and regulators could struggle to identify products requiring withdrawal or trace the root cause of a problem. This could trigger unnecessarily extensive recalls or delay the removal of genuinely unsafe food. The UK Food Security Report 2024 recognised cyberattacks as a significant threat to interconnected food supply chains.

The greatest threat may be the loss of public trust

Food safety depends not only on effective controls but also on public confidence. Consumers rightly expect manufacturers to produce safe food, retailers and foodservice operators to sell it responsibly, and government agencies to provide independent oversight. Imagine a major manufacturer announcing that it cannot establish whether millions of products were processed safely because its electronic records have been compromised. Regulators could face difficult decisions without reliable information about the extent of the problem. The Food Standards Agency (FSA) has the legal powers to require action to remove unsafe products from the market, even where contamination has not been confirmed, provided there are sufficient grounds to believe that consumer health may be at risk. Even if subsequent investigations identified no contamination, the reputational damage and financial costs could be considerable. Misinformation on social media would likely amplify public fears, while consumers might question whether industry and government had adequately anticipated the threat. For households already struggling with food prices and insecurity, further disruption could undermine confidence in the resilience of our food system.

I do wonder: if several major manufacturers were compromised simultaneously, would the UK have sufficient technical expertise, regulatory capacity and emergency arrangements to respond effectively? I am far from convinced this question has received sufficient attention.

We are living in different times, increasingly dangerous times, when a single keystroke by unseen forces operating in the darkest corners of the digital world can threaten our food supplies, undermine public safety and bring essential parts of modern society to their knees.”

From recognising the risks to taking action

Our food industry and the FSA are passionate about ensuring the food we eat is safe. Of this I have no doubt. But these are new and dangerous times, and both must respond quickly in several critical ways. For industry, cybersecurity should become an integral component of food safety management, including Hazard Analysis Critical Control Point (HACCP) related risk assessments and the identification and protection of critical control points. Second, food manufacturers and retailers must strengthen the security and reliability of operational control systems through independent safety checks, close monitoring, restricted remote access and robust recovery arrangements. Third, businesses must regularly test their response to cyber-induced food safety emergencies, including compromised processing records, disrupted traceability and major recalls.

Government has equally important responsibilities. The Department for Environment, Food & Rural Affairs (Defra), the NCSC, the FSA and Food Standards Scotland should jointly identify the most critical cyber vulnerabilities across food production, processing and distribution. Second, the government should introduce proportionate cybersecurity requirements for businesses operating essential food infrastructure, recognising that disruption to food production, processing, storage and distribution can have serious consequences for food safety, availability and public confidence. These requirements must be accompanied by practical guidance, technical support and financial assistance for smaller businesses, so cybersecurity improvements do not become unaffordable or leave weaker links in the food supply chain exposed. Third, the UK urgently needs a coordinated food-sector cybersecurity intelligence and emergency response framework that allows businesses, regulators and government agencies to share confidential information, identify emerging threats, issue early warnings and undertake joint exercises to prepare for major disruptions.

The Food Industry Intelligence Network (fiin) provides an excellent model, demonstrating how competing food businesses can collaborate confidentially to share intelligence, identify emerging risks and strengthen collective protection against food fraud. A similar approach to cybersecurity, potentially by expanding the fiin model, could provide a powerful collective defence against cyberterrorists while strengthening the resilience of the UK’s food supply chain.

The French supermarket attack should be regarded as a warning, not evidence that every feared scenario is inevitable. My proposed measures may seem an overreaction and could place further burdens on industry and government. But I believe they are essential to protecting public health, maintaining food supplies and preserving consumer confidence. We are living in different, increasingly dangerous times, when a single keystroke by unseen forces operating in the darkest corners of the digital world can threaten our food supplies, undermine public safety and bring essential parts of modern society to their knees.