Table of Contents
Supermarkets across Europe have been hit by a suspected cyber-attack affecting their fridges and freezers, raising concern about the vulnerabilities of internet-connected hardware from industrial machinery to humble domestic appliances. Smart devices connected to the internet can include fridges, central heating, and washing machines, making them easier to control remotely but also potentially exploitable by malicious actors.
Consumer Tech and Manufacturer Responsibilities
While major brands generally go to great lengths to ensure their technology is secure, exploits have been found in the past. In 2015, researchers demonstrated how a vulnerability in a Samsung smart fridge could allow them to intercept internet traffic, though there is no evidence domestic appliances are being targeted in the recent supermarket cyber-attacks in November as reported by BBC News. Ciaran Martin, former chief executive of the UK’s National Cyber Security Centre (NCSC), stated that manufacturers needed to do more to make connected devices secure. “There’s a lot more that we need to demand of big tech to give us safer devices and products in the first place,” he said, while advising consumers to keep devices updated and enable multi-factor authentication. Since April 2024, UK law has required manufacturers of certain consumer smart devices to meet minimum cyber security standards regarding passwords and security updates.
The NCSC stated it was working with international partners and industry to understand the supermarket incidents, though it was unaware of any impact on the UK. However, researchers from UK Cyber Defence have identified more than 800 refrigeration and building-control interfaces associated with British retailers that can be accessed over the public internet. While this does not necessarily mean they can be hacked, it could leave them exposed to attackers exploiting weak passwords or software vulnerabilities.
Retail Supply Chains and Industrial Risks
The government has already held talks with senior food retailers about cyber resilience following earlier attacks on supermarkets. Helen Dickinson, chief executive of the British Retail Consortium, stated that cyber incidents are a major concern for retailers, with businesses working alongside the NCSC to share intelligence and strengthen their defences. When UK supermarkets M&S and the Co-op were targeted by ransomware hackers in May 2025, retailers struggled to stock shop shelves with fresh deliveries, leading to customer complaints across the UK.
Tom Hegel, a researcher at cyber-security firm SentinelOne, noted that retailers must clarify responsibility. “The question retailers need to answer is who owns the security of that equipment, not just who repairs it,” he said, explaining that internet connectivity enhances convenience but security must keep pace. “Once an attacker can operate those controls, legitimate functions such as defrosting become tools for disruption,” he added, noting that changing a setting can destroy physical stock rather than merely interrupt a computer system.
Vulnerabilities in Cars, Power Plants, and Water Supplies
Outside of the home, connected technology is utilized to remotely manage industrial machinery and vehicles. Cyber security expert Ken Munro pointed to a 2015 demonstration where researchers remotely hacked a Jeep through its internet-connected entertainment system, which subsequently prompted vehicle security improvements. “Fortunately, the vehicle industry woke up to this and fixed the problem,” he said. Mobile connections are also widely used to monitor equipment in power plants and water networks, allowing engineers to manage systems remotely.
Munro stated that UK utilities were generally proficient at securing these connections, although standards varied around the world, expressing primary concern for smaller, poorly funded utility companies that may still rely on older, vulnerable equipment. Without proper protections, any factory or equipment connected to the internet, ranging from carmakers to electricity or transport infrastructure, could face similar risks, according to Olivier Daloy, a cybersecurity expert at Zscaler.
