UK food supply chain vulnerable to hostile cyber-attacks, NAO warns

The UK food supply chain is facing an escalating threat from hostile cyber-attacks that could jeopardize national food security. The National Audit Office (NAO) has identified these digital threats, alongside climate change and disease, as major risks to the stability of the nation's food infrastructure.

According to the NAO, recent incidents underscore the potential for severe operational and financial damage. Marks & Spencer estimated the cost of a 2025 cyberattack at approximately £300 million ($400 million), while a separate attack on the Co-op resulted in the theft of data from 6.5 million members. Gareth Davies, head of the NAO, noted that while recent disruptions have demonstrated some resilience within the system, the risks are increasing in both likelihood and severity.

The Cost of Efficiency

The vulnerability stems largely from a systemic shift toward lean operations. To reduce costs for both businesses and consumers, the UK food supply chain has evolved to prioritize maximum efficiency. However, this approach has stripped away the redundancy necessary to withstand significant shocks. By removing buffers to save money, the industry has inadvertently created a fragile environment where a single digital failure can cascade through the network.

Systemic Implications

These vulnerabilities pose a direct threat to the movement of goods. Cyber-attacks on food infrastructure can trigger immediate operational failures, such as the disconnection of warehouse management systems. Such outages disrupt both online and in-store order fulfillment, potentially leading to empty shelves and lost revenue. Over the next five to ten years, the increasing severity of these threats may further threaten national food security as the cost of defense rises and the impact of disruptions grows.

Governance Gaps

While the Department for Environment, Food & Rural Affairs (Defra) is responsible for coordinating preparedness, its own digital capabilities have come under scrutiny. Defra admitted that two-thirds of its customer interactions still rely on paper-based forms, suggesting a significant lag in the modernization of the very infrastructure tasked with overseeing the sector's resilience. Observers will be watching whether the government can accelerate the digitalization of Defra and whether retailers will pivot back toward redundancy to safeguard the supply chain.