UK food supply chain at risk from hostile attacks

A UK watchdog has warned that cybercriminals could pose a significant threat to the country's food supply chain following attacks on Co-op and Marks & Spencer last year. The National Audit Office (NAO) identified cyber-attacks as one of the major risks to the food supply chain and suggested the Department for Environment, Food & Rural Affairs (Defra) should collaborate closely with the industry to mitigate potential disruptions.

Gareth Davies, head of the NAO, emphasized that while the UK's food supply chain has demonstrated resilience to cyber-attacks, the risks are growing in both likelihood and severity. The government should learn from other countries' experiences and strengthen emergency preparedness by testing plans with local government and industry.

The NAO's report revealed that businesses in the food supply chain have experienced increased costs and operational disruptions due to cyber-attacks, including the £136 million ($177.2 million) loss estimated by Marks & Spencer following a 2025 attack. The Co-op also reported that hackers stole data from 6.5 million of its members.

The NAO noted that the food supply chain's focus on efficiency has reduced costs for businesses and consumers but has made the sector more vulnerable to shocks. Defra is less confident about businesses' ability to withstand shocks without government intervention in the next five to ten years due to increasing risks and potential for more severe disruptions.

The NAO found that several food supply chain organizations have made substantial investments to manage the threat and incidence of cyber-attacks, although some cited the substantial economic pressure on businesses as a hindrance to these investments. Defra admitted that two-thirds of its interactions with its 21 million customers still require paper-based forms, highlighting the need for improved digital infrastructure in the government sector.