Cyber-attacks targeting supermarket refrigeration systems have raised fresh concerns about the security of internet-connected devices, from household appliances to critical infrastructure.
A suspected cyber-attack affecting supermarket fridges and freezers across Europe has highlighted the potential risks associated with internet-connected technology. The incident has prompted wider questions about how vulnerable everyday appliances, industrial machinery and essential services could be to hackers.
Internet-connected devices, often referred to as smart technology, include household appliances such as refrigerators, washing machines and central heating systems. While internet access allows users and businesses to operate equipment remotely, it can also create opportunities for cybercriminals to exploit security weaknesses.
However, the fact that a device is connected to the internet does not automatically mean hackers can easily take control of it. Major manufacturers generally invest significant resources in protecting their products, although vulnerabilities have been discovered in some devices.
Smart appliances are not immune to hacking
In 2015, security researchers demonstrated that a vulnerability in a Samsung smart refrigerator could allow them to intercept internet traffic.
Despite such incidents, there is currently no evidence that household appliances were targeted in the supermarket cyber-attacks reported in November.
Ciaran Martin, former chief executive of the UK’s National Cyber Security Centre (NCSC), believes technology manufacturers must take greater responsibility for protecting connected devices.
“There’s a lot more that we need to demand of big tech to give us safer devices and products in the first place,” he said.
Martin also encouraged consumers to install software updates regularly and activate multi-factor authentication whenever it is available.
“I know it’s a pain, but it only takes a few seconds,” he added.
In the UK, legislation introduced in April 2024 requires manufacturers of certain consumer smart devices to meet minimum cybersecurity standards. These include requirements relating to passwords and security updates.
The NCSC said it was working with international partners and industry representatives to understand the supermarket incidents, although it was not aware of any impact on the UK.
However, researchers at UK Cyber Defence have identified more than 800 refrigeration and building-control interfaces associated with British retailers that are accessible through the public internet.
This does not necessarily mean the systems can be hacked, but their exposure could create opportunities for attackers to exploit weak passwords or software vulnerabilities.
Retailers face growing pressure to strengthen security
The UK government has already held discussions with senior food retailers about improving cyber resilience following previous attacks on the sector.
Helen Dickinson, chief executive of the British Retail Consortium, has described cyber incidents as a major concern for retailers. Businesses are working with the NCSC to exchange intelligence and strengthen their defences.
The potential consequences of attacks on supermarket systems became clear in May 2025, when retailers M&S and the Co-op were targeted by ransomware hackers.
Both businesses experienced difficulties stocking some shelves with fresh deliveries, while customers across the UK reported empty shelves in the days after the incidents.
Tom Hegel, a researcher at cybersecurity company SentinelOne, said retailers needed to establish who was ultimately responsible for securing the equipment they use.
“The question retailers need to answer is who owns the security of that equipment, not just who repairs it,” he said.
Although internet connectivity makes everyday technology more convenient, Hegel warned that security measures must develop alongside it.
“Once an attacker can operate those controls, legitimate functions such as defrosting become tools for disruption,” he explained.
“Changing a setting can destroy physical stock, not just interrupt a computer system.”
Could cars, power plants and water supplies also be at risk?
The security concerns extend well beyond supermarkets and household appliances. Internet-connected technology is increasingly used to monitor and operate industrial machinery, vehicles and essential infrastructure remotely.
Cybersecurity expert Ken Munro highlighted a demonstration from 2015 in which researchers remotely hacked a Jeep through its internet-connected entertainment system.
The incident raised serious questions about vehicle security and prompted improvements across the automotive industry.
“Fortunately, the vehicle industry woke up to this and fixed the problem,” Munro said.
Mobile connections are also widely used to monitor equipment in power stations and water networks, allowing engineers to manage systems from remote locations.
Munro said UK utility companies were generally good at protecting these connections, although security standards differ across countries.
He expressed particular concern about smaller utility providers with limited funding, some of which may still depend on older and potentially vulnerable equipment.
Olivier Daloy, a cybersecurity expert at Zscaler, warned that any internet-connected factory or equipment could face similar risks if appropriate protections were not in place.
This could include everything from car manufacturing facilities to electricity networks and transport infrastructure.
The challenge of securing an increasingly connected world
The supermarket incidents demonstrate how cyber-attacks can extend beyond computer systems and affect physical operations, businesses and supply chains.
As more devices become connected to the internet, the potential consequences of security weaknesses are becoming increasingly significant.
While manufacturers, retailers and infrastructure operators have a responsibility to protect their systems, consumers also have a role to play by keeping their devices updated and using available security features.
The wider challenge is ensuring that the convenience of connected technology does not come at the expense of security.
