Food, water and cyberattacks: what the government warnings really mean

Three days of food and water. A torch, a charged power bank and some cash.

The UK government’s latest emergency advice is a reminder of how quickly ordinary life becomes difficult when the services behind it stop working. Paying for shopping, contacting family, accessing medication and keeping a business open all depend on systems that are usually taken for granted.

Launched on 22 October, the Be Ready campaign encourages households to prepare for temporary disruption. Severe weather is a central concern, but ministers have also highlighted cyberattacks and the possibility of interruptions to essential supply chains.

For businesses, that warning deserves attention. When digital systems fail, the consequences can reach well beyond an IT department.

Why the government is asking people to prepare

The campaign asks households to keep enough essentials to manage for three days while support reaches those who need it most.

Its checklist includes non-perishable food, bottled water, medication, warm clothing, a battery-powered or wind-up radio, and a way to charge a phone. Cash is also recommended in case electronic payments or cash machines become unavailable.

The advice is deliberately practical. People are encouraged to check what they already have and build supplies gradually, according to their circumstances. For drinking water, the recommendation is three litres per person per day, with more needed for cooking and washing.

This is the first stage of a three-year campaign, building on household preparedness guidance available since May 2024. The government had announced plans for the campaign in July, ahead of October’s PHP2Shell disclosures.

Its purpose is to help people cope with a range of emergencies. A storm, power failure or cyber incident can have different causes while leaving households facing similar problems: services unavailable, information difficult to access and everyday purchases harder to make.

The supermarket checkout explains the concern

Speaking on the campaign’s launch day, Defence Secretary Wes Streeting raised a question that brings the issue into focus:

“How would we cope if the payment systems at the local supermarket went down?”

A shop can have staff at the tills and products on its shelves, yet still struggle to serve customers if the technology supporting transactions becomes unavailable.

The same dependency runs through the wider economy. Retailers rely on stock-management systems. Suppliers need ordering platforms. Delivery businesses depend on scheduling and communications. Organisations use online services to access documents, coordinate staff and respond to customers.

A failure in one place can create problems elsewhere. A business might have functioning computers and internet access but still be unable to fulfil orders because a supplier’s systems are down.

That is why the government’s message has relevance beyond household cupboards. It asks people to consider what they would need if familiar services stopped working. Businesses should be making the same assessment.

Cyber disruption can have physical consequences

This month’s attacks on supermarket refrigeration systems in France demonstrate how directly a cyber incident can affect everyday essentials.

Hundreds of stores were affected, with disrupted refrigeration putting food stocks at risk. France’s CERT-FR issued its first alert on 12 October, identifying compromises of remote refrigeration controllers.

In evidence to the French Senate on 21 October, ANSSI director Vincent Strubel pointed to basic security failures, including equipment exposed directly to the internet and weak passwords.

This was a separate incident from PHP2Shell. Its significance is the connection between digital access and physical operations: weaknesses in the systems controlling equipment can lead to damaged stock, interrupted trading and costly recovery.

For businesses using connected equipment, protecting laptops and email accounts is only part of the job. Refrigeration controls, building systems, network devices and remote maintenance connections also need clear ownership, appropriate access controls and ongoing support.

Where PHP2Shell fits into the picture

PHP2Shell adds urgency to the wider discussion about digital resilience.

Since our initial report, the US Cybersecurity and Infrastructure Security Agency has added both original vulnerabilities to its Known Exploited Vulnerabilities catalogue. Palo Alto Networks has also confirmed attacks against internet-exposed PAN-OS management interfaces.

Those developments show that the risk extends beyond conventional websites. Software components can sit inside products and services without their users being aware of them.

However, the official announcements reviewed do not establish that PHP2Shell prompted the UK’s emergency-supplies campaign. The campaign was already planned. The connection is broader: incidents such as PHP2Shell show why organisations need to understand their dependencies and be ready to respond when a widely used technology becomes vulnerable.

What this means for UK businesses and technology providers

For the technology sector, the challenge is both prevention and continuity. Customers need confidence that vulnerabilities are being addressed, alongside a realistic plan for keeping essential work moving during an outage.

That starts with knowing what the business depends on. Which systems are necessary to take payments, fulfil orders, access records and contact customers? Who maintains them? Which suppliers could interrupt those activities if their own services failed?

Responsibility needs to be explicit. A website developer, hosting company, software vendor and internal IT team may each manage different parts of the same service. An urgent security update can be delayed if everyone assumes someone else is applying it.

Businesses should also test the arrangements they expect to rely on during disruption. Backups need to be recoverable. Emergency contact details need to be accessible without the usual login. Staff need to know how decisions will be communicated if email or collaboration platforms are unavailable.

Where safe and practical, simple fallback procedures can help maintain essential work. These should be agreed in advance, with clear limits, rather than improvised during an incident.

Put preparedness into practice

The government is asking households to think through a short period without the services they normally rely on. That is a useful exercise for any organisation.

Choose a realistic scenario: the payment platform is unavailable, a key supplier cannot process orders, or staff lose access to shared systems. Then work through what happens during the first hour, the first day and the next three days.

The gaps that emerge are the priorities to address.

For households, preparedness might mean food, water and a charged power bank. For businesses, it means knowing which services matter most, who is responsible for them and how operations will continue while they are restored.