Suspected cyber-attack on supermarket freezers raises fears over connected technology

A suspected cyber-attack that hit fridges and freezers at supermarkets across Europe has renewed concern about the security of internet-connected hardware, ranging from industrial machinery to ordinary domestic appliances.

Smart devices that go online can include fridges, central heating systems and even washing machines. That connectivity makes them easier to control remotely, but in theory any device connected to the internet can potentially be exploited by malicious actors. Security specialists caution that this does not mean hackers can easily take control, and big brands generally go to great lengths to make sure their technology is secure.

Exploits have been found before. In 2015, researchers demonstrated how a vulnerability in a Samsung smart fridge could allow them to intercept internet traffic. However, there is no evidence domestic appliances were targeted in the cyber-attacks that struck supermarkets in November.

Ciaran Martin, former chief executive of the UK's National Cyber Security Centre (NCSC), said manufacturers needed to do more to make connected devices secure. "There's a lot more that we need to demand of big tech to give us safer devices and products in the first place," he said. He advised consumers to keep devices updated and to enable multi-factor authentication wherever possible, adding: "I know it's a pain, but it only takes a few seconds."

Since April 2024, UK law has required manufacturers of certain consumer smart devices to meet minimum cyber security standards, including rules around passwords and security updates. The NCSC said it was working with international partners and industry to understand the supermarket incidents, but was unaware of any impact on the UK.

Even so, researchers from UK Cyber Defence have identified more than 800 refrigeration and building-control interfaces associated with British retailers that can be accessed over the public internet. That does not necessarily mean they can be hacked, but it could leave them exposed to attackers exploiting weak passwords or software vulnerabilities. The government has already held talks with senior food retailers about cyber resilience following earlier attacks, and Helen Dickinson, chief executive of the British Retail Consortium, has said cyber incidents are a major concern for retailers, with businesses working alongside the NCSC to share intelligence and strengthen their defences.

It would not be the first time hacks have raised concern about the impact on food supply. When UK supermarkets M&S and the Co-op were targeted by ransomware hackers in May 2025, the retailers struggled to stock some shop shelves with fresh deliveries, and customers across the UK complained of empty shelves in the days that followed.

Tom Hegel, a researcher at cyber-security firm SentinelOne, said retailers must be clearer about responsibility. "The question retailers need to answer is who owns the security of that equipment, not just who repairs it," he said. "Once an attacker can operate those controls, legitimate functions such as defrosting become tools for disruption. Changing a setting can destroy physical stock, not just interrupt a computer system."

Outside the home, connected technology is used to remotely manage industrial machinery and vehicles. Cyber security expert Ken Munro pointed to a 2015 demonstration in which researchers remotely hacked a Jeep through its internet-connected entertainment system, prompting improvements in vehicle security. "Fortunately, the vehicle industry woke up to this and fixed the problem," he said. Mobile connections are also widely used to monitor equipment in power plants and water networks, allowing engineers to manage systems remotely. Munro said UK utilities were generally good at securing these connections, but standards varied around the world, and his biggest concern was smaller, poorly funded utility companies that may still rely on older, vulnerable equipment.

Olivier Daloy, a cybersecurity expert at Zscaler, warned that without proper protections, "any factory or equipment" connected to the internet, from carmakers to electricity or transport infrastructure, could face similar risks.