The UK's food supply chain faces increasing risks from cyberattacks, according to a report from the National Audit Office (NAO). The watchdog highlighted cyber threats as a significant concern, capable of causing severe disruptions and contributing to food price inflation. The NAO's findings suggest that while the sector has demonstrated some resilience, the government, specifically the Department for Environment, Food & Rural Affairs (Defra), needs to collaborate more closely with industry stakeholders to bolster defenses and mitigate potential impacts.
The report, published late last week, cited recent cyberattacks on major retailers as examples of the escalating threat. Marks & Spencer, for instance, estimated that an attack in April of last year would incur costs totaling approximately £136 million ($177.2 million). The retailer confirmed that its incident response included disconnecting warehouse management systems, which subsequently affected both online and in-store order fulfillment.
Another significant incident involved the Co-op, which confirmed that data belonging to 6.5 million of its members was compromised during a cyberattack last year. These events underscore the potential for cyber incidents to disrupt core digital systems, increase operational costs for businesses, and impact day-to-day operations across the food supply chain.
The NAO noted that the food supply chain's historical prioritization of efficiency, while beneficial for cost reduction, has inadvertently increased its vulnerability to disruptions. Defra and other stakeholders acknowledge these growing risks, and businesses are reportedly making substantial investments to counter the threat of cyberattacks. However, the NAO also observed that broader economic pressures are making it more challenging for some businesses to fund these crucial resilience investments.
Defra has stated that it has conducted specific food-related exercises since 2023, focusing on testing responses to cyber incidents affecting the food sector. Despite these efforts, concerns remain regarding Defra's capacity to provide technical guidance, given its own admission in 2023 that two-thirds of its customer interactions still rely on paper-based forms, and 30 percent of its applications were out of support.
Gareth Davies, head of the NAO, emphasized that while recent disruptions have showcased the resilience of the UK's food supply chain, the likelihood and severity of risks are on the rise. He urged Defra to learn from international approaches and enhance emergency preparedness by conducting more rigorous testing of plans with local government and industry partners. The NAO's assessment indicates that Defra is less confident in the ability of businesses to withstand future shocks without government intervention over the next five to ten years, due to the increasing risks and potential for more severe disruptions.
