Cyber-attack on supermarket freezers raises alarm over connected devices

Supermarkets across Europe have been hit by a suspected cyber-attack affecting their fridges and freezers, prompting concern about the security of internet-connected hardware, from industrial machinery to household appliances.

Smart devices that go online include fridges, central heating systems and washing machines. Connectivity makes them easier to control remotely, but in theory any device that goes online can be exploited by malicious actors.

That does not mean hackers can easily seize control of them, and large manufacturers go to considerable lengths to secure their technology. Exploits have been found before: in 2015 researchers showed how a vulnerability in a Samsung smart fridge could let them intercept internet traffic.

There is no evidence that domestic appliances were targeted in the attacks on supermarkets in November 2026.

Manufacturers need to do more to make connected devices secure, said Ciaran Martin, former chief executive of the UK's National Cyber Security Centre (NCSC).

"There's a lot more that we need to demand of big tech to give us safer devices and products in the first place," he said.

Martin advised consumers to keep their devices updated and to enable multi-factor authentication wherever possible. "I know it's a pain, but it only takes a few seconds," he said.

Since April 2024, UK law has required manufacturers of certain consumer smart devices to meet minimum cyber security standards, including requirements on passwords and security updates.

The NCSC said it was working with international partners and industry to understand the supermarket incidents, but was unaware of any impact in the UK.

Researchers from UK Cyber Defence have identified more than 800 refrigeration and building-control interfaces linked to British retailers that can be reached over the public internet. That does not necessarily mean they can be hacked, but it could leave them exposed to attackers exploiting weak passwords or software flaws.

The government has already held talks with senior food retailers about cyber resilience, following earlier attacks on supermarkets. Cyber incidents are a major concern for retailers, which are working with the NCSC to share intelligence and strengthen their defenses, said Helen Dickinson, chief executive of the British Retail Consortium. It would not be the first time hacks have raised concern about the impact on food supply.

Retailers must be clearer about responsibility, said Tom Hegel, a researcher at the cyber-security firm SentinelOne.

"The question retailers need to answer is who owns the security of that equipment, not just who repairs it," he said.

Connectivity makes everyday technology more convenient, but security has to keep pace, Hegel said. "Once an attacker can operate those controls, legitimate functions such as defrosting become tools for disruption," he said. "Changing a setting can destroy physical stock, not just interrupt a computer system."

Outside the home, connected technology is used to manage industrial machinery and vehicles remotely. Cyber security expert Ken Munro recalled a 2015 demonstration in which researchers hacked a Jeep remotely through its internet-connected entertainment system, which led to improvements in vehicle security.

"Fortunately, the vehicle industry woke up to this and fixed the problem," Munro said.

Mobile connections are also widely used to monitor equipment in power plants and water networks so that engineers can manage systems from a distance. UK utilities are generally good at securing those links, though standards vary around the world, Munro said. His biggest concern was smaller, poorly funded utility companies that may still rely on older, vulnerable equipment.

Without proper protections, any factory or equipment connected to the internet, from carmakers to electricity or transport infrastructure, could face similar risks, said Olivier Daloy, a cybersecurity expert at Zscaler.