Ransomware attack hits food supply chain, exposes retail risks

The recent confirmation that Peter Green Chilled has been subjected to a ransomware attack, leading to extensive disruption of food deliveries across the UK, has intensified scrutiny over cybersecurity standards in the retail and logistics sectors. The attack, which left supermarket shelves exposed to supply chain delays, comes amid similar high-profile incidents affecting Marks & Spencer, the Co-op, and Harrods in recent months.

Peter Green Chilled, a major distributor of refrigerated goods to prominent supermarket chains, is now grappling with the ongoing consequences of the breach. Experts caution that these attacks, increasingly aimed at the backbone of national supply chains, can trigger widespread consequences, from empty shelves to consumer panic buying and logistical bottlenecks.

Andy Norton, European Cyber Risk Officer at Armis, noted, "These incidents highlight the increasingly high stakes in retail—a sector where even brief disruptions can lead to empty shelves, trigger panic buying, and cause wider supply chain issues." Norton pointed out that the sector's extensive digital supply chains, reliance on operational continuity, and possession of substantial customer data, make it a prime target for cybercriminals. According to Armis Labs, 41% of retailers have encountered a rise in cyber threat activity over the past six months. Norton added, "This reinforces the need for a proactive cybersecurity strategy that provides organisations with a full understanding of their attack surface so that they can effectively defend and manage it."

Data collected by Armis Labs reveals that 79% of global IT decision makers in retail have prioritised a shift to proactive cybersecurity in the coming year. Notably, nearly half of the retail organisations surveyed admitted that previous hacking incidents have left their digital ecosystems insufficiently secured. Complexity in regulatory requirements continues to overwhelm security teams, with 46% reporting significant challenges in keeping up with evolving rules. Despite this, around 82% of employees in retail reportedly know who to contact within their organisation if they observe suspicious cyber activity—an encouraging sign of growing internal awareness.

Security analysts warn that the threat landscape is becoming ever more sophisticated and persistent. Nir Dvorkin, Senior Cyber Security Analyst at Cynet Security, explained that the attack on Peter Green Chilled "isn't an isolated event. It's the latest in a wave of cyberattacks targeting the UK retail sector... These disruptions don't just affect business operations; they ripple across supply chains and consumer access to essential goods, highlighting how digital threats are now directly impacting the physical world."

Dvorkin detailed how the tactics employed in the attack show similarities to operations linked to Scattered Spider, also known as UNC3944, a group known for its adaptive approach and focus on large organisations in the UK and US. Traditionally using phishing and SIM-swapping techniques, Scattered Spider has evolved to blend help desk impersonation, SMS phishing, and the exploitation of legitimate remote access tools—a combination that relies as much on social manipulation as technical prowess. "These attacks aren't opportunistic. They're carefully engineered to bypass controls and exploit the very people and tools organisations rely on every day," Dvorkin said.

To protect against such threats, Dvorkin recommends a layered defence strategy. This includes not only robust technical controls such as enforced multi-factor authentication (MFA) and vigilant monitoring for suspicious password resets or MFA enrolment, but also the limitation of remote administration tool usage to only approved scenarios. Notably, IT and administrative staff should receive regular training to identify sophisticated social engineering attempts, while security teams are advised to monitor for atypical user activity that may indicate a breach.

With retail organisations increasingly noting groups such as Anonymous, DarkSide, and APT41 among those they most fear, and with only 46% claiming real-time detection and response capabilities, the pressure is mounting for the sector to invest decisively in proactive cyber defences. As digital attacks bleed into the physical world, threatening the steady supply of food and essentials to millions, the imperative for collaboration between technology, training, and regulation in retail has never been stronger.