A cyberattack on a critical food-distribution network could turn a commercial breakdown into a national-security crisis by disrupting the systems that keep Britain’s supermarkets supplied. Europe’s food system has already had a glimpse of what cyber disruption looks like. Cyberattacks across the continent have manipulated temperatures, destroyed food stocks, and caused fires, while France has accused an Iranian Revolutionary Guard-linked cyber unit of orchestrating attacks on around 700 retail sites. Britain’s National Cyber Security Centre is warning that artificial intelligence could allow hostile actors to identify and exploit such weaknesses at a scale previously impossible. Together, these incidents expose the vulnerability of digitally connected commercial food infrastructure.
For the UK, the danger is not simply that individual supermarkets, farms, or logistics firms can be hacked. Decades of consolidation, import dependence, just-in-time logistics, and digitalization have concentrated food distribution around a relatively small number of critical systems and chokepoints. The strategic question is whether an attack on one of them could cascade through the wider food system, and how much disruption Britain could absorb before a commercial cyber incident became a national-security problem.
Cyber-attacks against food systems can take many forms, including theft of sensitive data, disruption of production and distribution systems, ransomware attacks, and sabotage of critical digital infrastructure. Attacks on supermarkets have caused millions of euros in losses. In a period of rising geopolitical tensions, governments are increasingly concerned that hostile states could target food systems as a form of hybrid warfare.
In a period of rising geopolitical tensions, governments are increasingly concerned that hostile states could target food systems as a form of hybrid warfare
Why Britain is Especially Exposed
The UK’s vulnerability to a major cyber-attack is not simply a technical problem of preparedness. Rather, its expanded cyber-attack surface is rooted in four interrelated processes driven by large-scale, high tech, industrial expansion: 1) the concentration of retail power, 2) the globalization of food supply chains including the UK’s increasing import dependence, 3) the growing digitalization of agriculture and food distribution, and 4) the pre-eminence of just-in-time (JIT) production and delivery systems.
The UK’s exposure is not unusual because of any single vulnerability, but because several reinforce one another. Import dependence increases reliance on ports and freight systems; concentrated retail and distribution amplify the consequences of disruption at individual nodes; just-in-time logistics leave limited inventories to absorb delays; and the absence of substantial strategic reserves reduces the state’s capacity to compensate when commercial supply chains fail.
In response to such vulnerabilities, the government has designated the food system as one of the UK’s thirteen critical national infrastructure sectors and committed to improving resilience. However, policy largely focuses on strengthening the existing system rather than addressing the structural sources of its vulnerability. The UK state thus finds itself in a quandary: building a genuinely resilient food system would entail major trade-offs. It would be costly and politically contentious, requiring substantial public investment and institutional reform. Yet failing to achieve genuine food-system resilience could carry significantly greater long-term costs.
Cyber Attacks and the Food System
Global cyber-crime is rising. Between 2015 and 2025, estimated global losses increased from roughly $3 trillion to more than $10 trillion. In Europe, Ukraine has the highest frequency of customers impacted by cyber activity, followed by the UK and Germany.
The UK’s National Audit Office has identified cyber-attacks as a significant threat to the food supply chain. A successful attack could disrupt grain-drying systems, livestock monitoring technologies, weather and irrigation platforms, and the temperature and lighting controls upon which intensive livestock and poultry production depend. It could also interrupt inventory management systems, food-traceability databases, transport scheduling software, automated warehouse operations, electronic payments, and retailers’ stock replenishment systems.
Recent incidents illustrate the scale of the threat. In April 2025 a cyber-attack on Marks & Spencer disrupted warehouse management and online and in-store ordering systems, costing the company an estimated £136 million. Following the attack, the company took parts of its IT infrastructure offline to contain the incident. This disrupted food distribution and inventory management, reducing food availability in some stores.
A cyberattack targeting freight or warehouse-management systems linked to Dover could initially delay particular shipments, but the effects would not necessarily remain localized. In a just-in-time system, delayed imports could quickly affect distribution centers, processors, wholesalers, and supermarket replenishment. Shortages could then trigger precautionary buying, accelerate stock depletion, increase competition for replacement transport and supplies, and turn a temporary digital disruption into a broader physical supply shock.
Shortages could then trigger precautionary buying, accelerate stock depletion, increase competition for replacement transport and supplies, and turn a temporary digital disruption into a broader physical supply shock
To date, many attacks against food businesses have been financially motivated, typically involving ransomware and extortion. Attackers encrypt company systems and demand payment in exchange for restoring access. However, security analysts and military planners are increasingly concerned that hostile states could employ similar methods to disrupt critical national infrastructure.
A hostile state would not necessarily need to disable the UK food system permanently for an attack to have strategic value. During a wider geopolitical crisis, disruption to food distribution could raise prices, generate uncertainty, absorb government attention, and undermine public confidence. Such pressure could complement military, diplomatic, or economic coercion by increasing the domestic costs of sustaining an assertive foreign-policy position. The UK government identifies Russia as a major state-linked cyber threat, while China and Iran are also increasingly associated with hostile cyber activity against critical infrastructure.
Food-system disruption therefore has implications beyond consumer welfare. During a geopolitical crisis, shortages, price increases, or sustained disruption could weaken social cohesion, consume emergency resources, and increase the domestic political costs of maintaining foreign policy commitments. Food-system resilience is therefore also a question of state capacity.
Transformations of the UK’s Food System
The contemporary UK food system is marked by a central paradox—greater technical efficiencies and global integration at the cost of heightened domestic vulnerability.
Over recent decades, retailer-controlled supply chains have cut redundancy (excess capacity) significantly. Through barcoding, electronic data interchange, real-time inventory management, digitalized warehouse management and just-in-time logistics, supermarkets can deploy near-instantaneous stock replenishment systems.
The deployment of digital technologies has enabled retailers to increasingly control supply chains and consolidate their market power—specifying product quality, quantity, timing of delivery and even prices paid to suppliers.
In 1950, independent grocers and consumer cooperatives accounted for almost four-fifths of grocery sales. By 1984, their combined share had fallen to around 30%. Today, the nine largest retailers account for more than 90% of all food sales.
Government policy has facilitated this transformation. The 1990 Food Safety Act shifted primary responsibility for food safety from state inspectors to food businesses. This legislative shift strengthened further retailer power, which was then used to manage supply chains closely.
Retailers have used their enhanced market power to place downward price pressure on suppliers. One consequence has been the long-term squeeze on farm incomes.
The food system’s vulnerabilities are magnified by increased import dependence. Whereas UK food self-sufficiency stood at roughly 75% in the early 1980s, by 2025 it had fallen to around 65%. Domestic production relies heavily on imported inputs. Around 60% of fertilizer used in UK agriculture is imported, creating additional exposure to disruptions in international trade and logistics.
By comparison, countries such as the United States, France, and Australia retain much higher levels of self-sufficiency. The Netherlands and Spain produce approximately 80% and 75% of their food requirements respectively, highlighting the UK’s relatively fragile position.
Food import and distribution is highly concentrated. According to the National Preparedness Commission, the Dover-Calais, Dover-Dunkerque and Channel Tunnel freight corridors constitute critical routes for food imports. Across the country, roughly 12,000 food stores are supplied by just 131 distribution centers. Tesco—the largest UK retailer—accounts for almost one-third of UK grocery sales and depends upon a relatively small network of distribution facilities to supply thousands of stores. These vulnerabilities are magnified by the erosion of institutional safeguards that once protected the UK against supply disruptions.
The UK has dismantled many of the buffers that once protected it from supply disruptions. Britain previously maintained substantial strategic food reserves, originally established during the Second World War and expanded during the Cold War. At their peak, these reserves contained approximately 750,000 tons of food. The system was progressively dismantled after 1991 and disappeared entirely by 1996. Switzerland, by contrast, continues to maintain strategic food reserves capable of sustaining its population for several months and is expanding them further.
The same processes that concentrated retail power and increased import dependence have also reshaped agriculture itself. Farmers are increasingly integrated into complex, digitally coordinated supply chains that extend from input suppliers to retailers.
Upstream from farming, agribusiness firms have helped create a “smart agriculture” ecosystem in which farmers rely on interconnected digital technologies, software, and data. Automated milking systems, precision fertilizer application, satellite-guided machinery and livestock-monitoring technologies are increasingly common across UK agriculture. For example, automated tractor guidance and auto steer is used by 76% of arable farmers.
However, farmers face a growing tension—continued economic pressures while increasing dependence upon digital infrastructures they often lack the resources to protect adequately.
Many farms operate with limited cyber-security expertise and depend upon highly time-sensitive production systems. A successful cyber-attack can disrupt feeding regimes, disable machinery, lock operators out of management systems, interrupt harvesting schedules, and delay input and product deliveries.
A more localized, or regionalized, agroecological food system could enhance resilience by dispersing production, distribution, and decision-making across a wider range of actors and places. Shorter supply chains, a larger number of producers, and more decentralized distribution networks would increase redundancy. It would also reduce reliance on complex digital coordination and limit the ability of cyber-attacks to generate system-wide disruption. However, establishing such a system would be costly and entail significant political and economic contestation.
Two Paths Ahead
Cybersecurity is a necessary component of food-system resilience, but it is not sufficient. Alongside strengthening digital defenses, the UK government could reduce systemic vulnerability by investing in regional food storage and distribution networks and supporting greater domestic food production. Such measures would lessen dependence on imports and on the long supply chains that currently provision much of the country’s food.
Cybersecurity is a necessary component of food-system resilience, but it is not sufficient
One option is to strengthen the existing system through better cybersecurity, emergency planning, and protection of critical infrastructure. This would preserve most of the efficiencies of the current model, but it would not remove the underlying risks created by concentration, low inventories, import dependence, and limited redundancy.
A second option is to reduce those structural vulnerabilities themselves by increasing redundancy, expanding domestic capacity, diversifying supply chains, and shortening or decentralizing some distribution networks. Such measures could make disruption at individual nodes less consequential, but they would also impose higher fiscal and economic costs.
One element of such a strategy could be rebuilding domestic productive capacity along agroecological lines—methods that bring a more ecological approach to farming. Greater support for small and medium-sized farms, market gardens, and agroecological producers could diversify production while reducing dependence on complex international supply chains.
In the short term, such measures would be costly to the state and would probably raise production costs and prices. Producer and consumer subsidies might be required to keep prices down. A longer-term plan could potentially lower food costs by reducing reliance on volatile supply chains, cutting agro-chemical inputs, and improving soil quality and resilience in the face of climate change.
The costs would be significant. In 2024-25, DEFRA’s food and farming resource budget was just over £2 billion, while the government committed £5 billion over two years for sustainable farming and nature recovery. These sums, if applied to transforming the food system, could provide a starting point, but a serious transition would require considerably greater investment in domestic food production, local processing and distribution infrastructure. Whilst considerable, such spending should be viewed against the costs of maintaining an increasingly concentrated, digitized and vulnerable food system.
The Price of Resilience
The UK’s vulnerability to cyber-attacks is not simply a consequence of inadequate digital security, but of deeper transformations that have reshaped the food system over the past four decades. Giant retailers have consolidated their market power through just-in-time, digitally coordinated supply chains, while global sourcing has increased the UK’s dependence on imports. Successive governments have dismantled strategic food reserves. Together, these developments have produced a food system that delivers efficiency but remains vulnerable to disruption.
The UK’s vulnerability to cyber-attacks is not simply a consequence of inadequate digital security, but of deeper transformations that have reshaped the food system over the past decades
Current policy focuses primarily on strengthening cyber defenses within critical infrastructure and improving the resilience of existing supply chains. Such measures are necessary, but they leave untouched many of the structural features that generate vulnerability in the first place. A food system organized around a small number of dominant retailers, extensive import dependence, and tightly integrated digital infrastructures will remain exposed to disruption, regardless of how sophisticated its cybersecurity becomes.
The central short- to medium-term trade-off is that many of the measures that would improve resilience would also reduce efficiency. Maintaining larger food stocks, supporting more domestic production, diversifying supply chains, and creating greater redundancy in storage and distribution infrastructure would all increase costs. All things being equal, consumers would likely face higher food prices. Those costs would ultimately have to be distributed among taxpayers, producers, retailers, and consumers, creating different economic and political trade-offs depending on how government chose to allocate them.
The state would need to finance new investments through taxation or borrowing. Farmers might benefit from greater support and more stable market conditions, but only if governments were willing to sustain long-term intervention.
Food-system resilience is a form of national insurance. Maintaining strategic reserves, expanding domestic production and logistical redundancy entails ongoing costs, but these may be far lower than the consequences of major supply disruptions. The central question for policymakers is how much vulnerability they are willing to accept in exchange for efficiency.
In an era of intensifying geopolitical competition and AI-enabled cyber threats, the strategic question is therefore not simply how Britain can prevent attacks, but how much disruption its food system can absorb when prevention fails. The difficult choice is how much economic efficiency Britain is prepared to sacrifice for resilience, and who should bear the cost.
