Ransomware attack on food distributor spells more pain for UK supermarkets
- Reference: 1747743314
- News link: https://www.theregister.co.uk/2025/05/20/ransomware_attack_on_food_distributor/
- Source link:
According to UK public broadcaster the BBC, which saw emails to the customers, the ransomware attack took hold on May 14 and by the following day customers were informed via email.
Managing director Tom Binks said "the transport activities of the business" were continuing to run unchanged, although at the time of the emails sent on May 15, the company had said it wouldn't be processing new orders on that day.
[1]
The logistics provider [2]said it would not be making any further comments about the attack itself.
[3]
[4]
The Register contacted the company and Binks for more information, but it did not immediately respond.
The phone number listed for Peter Green Chilled on its website appears to be blocking inbound calls, and its general enquiries email address is not accepting incoming messages from senders outside the organization, an Office 365 bounceback stated.
[5]
Based in Somerset, Peter Green Chilled serves most major supermarkets in the UK, including Asda, Morrison's, Sainsbury's, Tesco, Waitrose – plus [6]Co-op and [7]M&S , which are battling their own cyber-related issues.
The distribution organization also offers temperature-controlled warehousing services and boasts its own on-site custom agency.
Wilfred Emmanuel-Jones, founder of The Black Farmer, spoke to the BBC's [8]Wake Up to Money radio show (at the 30:15 mark) this morning, saying his company has thousands of packets of meat, due to be delivered to supermarkets by Peter Green Chilled, currently sitting in limbo as a result of the attack.
[9]
He said: "I don't want to exaggerate, but it is pretty desperate because still we do not have a solution for how Peter Green is going to get our stock that is sitting in their warehouse delivered to the supermarkets. And if they're not delivered in the next couple of days, because they're fresh products, they have to be thrown away, and for a small business it is pretty devastating.
"To make matters even worse is that we've just also got a delivery that's come in from Sweden that is stuck at a port because Peter Green is not taking in any other stock from any suppliers, so we have to try and find some way of getting it to the supermarkets.
"If we do not get this stock out to the retailers, that's about a £40,000 (approx. $53,500) loss, not including the stock that's coming in, so you can be talking – just this week – around £100,000 (approx. $133,700) worth of stock, which for us as a small business, is pretty devastating."
According to the Financial Times, M&S is readying a [10]cyber insurance claim of up to £100 million (approx $133.7 million) to cover the costs associated with its ransomware attack, which has been ongoing since April.
That money will cover all costs related to recovering from the attack, from restoring systems, perhaps replacing them in some cases, plus the cost of downtime, which as illustrated by The Black Farmer, can rise to dizzying sums even for small businesses.
M&S is a much larger beast, however, and the profit & loss implications of the attack aren't likely to be confirmed for some months. Its annual financial results are due to be published on Wednesday, but these will only cover the year ending March 2025, the month before the attack took place.
Attacks on key supply chain players are often the most disruptive and more vivid – they play out in the public eye with the effects on daily life clear to see for all. Simple data smash and grabs are less attention-grabbing and not seen by the masses as substantially problematic.
However, ransomware crooks love supply chain attacks. The disruption that comes with them inherently builds pressure on the victim to pay, as their own costs rack up, as well as that of their business partners.
Raghu Nandakumara, head of industry solutions at Illumio, said: "this latest attack on Peter Green Chilled highlights a troubling trend: the UK retail sector is under siege from increasingly aggressive cybercriminals.
[11]Eeek! p0wned Alabama hit by unspecified 'cybersecurity event'
[12]Ex-NSA bad-guy hunter listened to Scattered Spider's fake help-desk calls: 'Those guys are good'
[13]Marks & Spencer admits cybercrooks made off with customer info
[14]British govt agents step in as Harrods becomes third mega retailer under cyberattack
"But it's not just retailers who suffer; these attacks directly impact the public. When systems go down, people can't shop for essentials or access services they rely on. The societal impact of attacks is significant.
"We're seeing a shift from data theft to outright operational disruption, as attackers target critical systems to force faster payouts. Ransomware is proving more damaging than isolated data breaches, with many businesses facing major [15]downtime , reputational harm, and financial loss. Now more than ever, retailers must prioritize [16]operational resilience and adopt controls that can prevent attackers from reaching their most vital systems." ®
Get our [17]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aCynHUfyKu-dPv7f3h6M3wAAAk0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.bbc.co.uk/news/articles/czr88myp570o
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCynHUfyKu-dPv7f3h6M3wAAAk0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCynHUfyKu-dPv7f3h6M3wAAAk0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCynHUfyKu-dPv7f3h6M3wAAAk0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/AMP/2025/05/15/cyber_scum_attacking_uk_retailers/
[7] https://www.theregister.com/2025/05/13/ms_confirms_customer_data_stolen/
[8] https://www.bbc.co.uk/sounds/play/m002cb54
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCynHUfyKu-dPv7f3h6M3wAAAk0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.ft.com/content/723b6195-1ce7-4b5f-94f5-729e9152c578
[11] https://www.theregister.com/2025/05/19/infosec_roundup/
[12] https://www.theregister.com/2025/05/18/ex_nsa_scattered_spider_call/
[13] https://www.theregister.com/2025/05/13/ms_confirms_customer_data_stolen/
[14] https://www.theregister.com/2025/05/02/ncsc_steps_in_as_harrods/
[15] https://www.theregister.com/2025/05/07/human_error_a_factor_in/
[16] https://www.theregister.com/2025/01/29/nao_blasts_uk_gov_cyber/
[17] https://whitepapers.theregister.com/
Re: Picture
Being surprised is often cheaper than paying us what we're worth, and what we save a company when the shit hits the fan.
Re: Picture
That's what manglement thinks.
Re: Picture
"while pretending tech talent is interchangeable"
It's not just software that's suffered that problem. All employees are seen as components to be ordered up. They should be ready made with minimal adaption needed. And when they break, they are thrown away and another hired.
These are terrorist attacks and the response should be appropriate.
Those responsible should be having unfortunate accidents when they least expect it. This is why we have the security services.
Any company likely to be at risk from these attacks should have a viable, tested fallback that continues their business operations using a mixture of resilient systems that do not touch the public internet and paper-based operations.
Note that Primark doesn't offer online ordering (although it has click and collect). Other retailers sell through ebay or Amazon. These may be better models for mainstream retail. Just use your own website for advertising and promotions.
Keep your internal systems and data on networks that do not touch the public internet. Do not use Cloud or SaaS systems that are internet dependent. Data is a risk not an asset, so retain as little of it as you can, and archive offline what you do not require daily access to.
Invest in good security, which matters, has value and works, not AI, which does not.
Re: These are terrorist attacks and the response should be appropriate.
Have core services such as the RDBMS that drives the rest connected to the rest of the business only through their data ports and not at all to the outside world*. No SSH or whatever. No other functionality. Maintenance only through the system console or at most a very small, dedicated network. Inconvenient? Ask M&S, the Co-op and all the rest about inconvenience.
Have a business resilience plan. Run exercises to test it. And test your backup and restores.
By now the boards of every big retail and distribution company in the country should be making this their top priority but I wonder how many are.
* Yes, I know this is makes updates tricky. It was much easier in my system minding day when updates came on CDs at intervals of some months from the vendor. It would need a process to verify the updates and the media to convey them across the air gap.
Re: These are terrorist attacks and the response should be appropriate.
There's a fatal and fundamental flaw in both Tron's and Docto Syntax's arguments.
The contain that two word obscene phase - "Common Sense".
They also have that - for the markets - unnerving feature of hitting the short term bottom line/share price. In other words they cost money.
Both things which get consigned to that strong metal box which management want to take deep into the woods, bury somewhere unmemorable and never speak of again.
All the eggs in one basket?
Why are so many companies relying on a single company? The food analogy seems rather appropriate.
Is it time to unplug from the internet?
Re: All the eggs in one basket?
Came here for this. Maybe they should try more baskets?
Picture
Ransomware hits, supply chains freeze, food spoils, businesses bleed cash. Everyone shocked to learn that cyberattacks don’t just affect “data” but real things - like trucks, fridges, and dinner.
Meanwhile, the UK continues its proud tradition of treating engineers as overpaid hobbyists who click mouse, clack keyboard and occasionally fix the printer.
For decades, we’ve built entire industries on software while pretending tech talent is interchangeable, disposable, or best outsourced. Infrastructure became digital, but priorities stayed firmly analogue.
Now, attackers don’t need guns or trucks - just a laptop and patience. And every time it happens, we act like it's a natural disaster. As if resilience is something you hope for, not something you build.
But sure, let’s keep being surprised. Maybe next time we’ll even prepare.