A suspected cyberattack on supermarkets has renewed concerns about the security of internet-connected equipment, including refrigerators, freezers and building-management systems. While there is no evidence that consumer electronics were targeted in the November attack, researchers have found hundreds of refrigeration and retail infrastructure interfaces accessible from the public internet.
Connected appliances can create security risks
Internet-connected devices include refrigerators, central-heating systems, washing machines and other household appliances. Connecting them to the internet can make remote control and monitoring easier, but any device that goes online could theoretically be exploited by a malicious attacker.
That does not mean hackers can easily take control of every connected appliance. Major brands typically invest heavily in securing their technology, but vulnerabilities have previously been discovered in some devices.
In 2015, researchers demonstrated that a vulnerability in Samsung’s smart refrigerator could allow internet traffic to be intercepted. However, there is no evidence that consumer electronics were targeted in the November cyberattack on supermarkets.
Calls for stronger security standards
Ciaran Martin, the former chief executive of the UK’s National Cyber Security Center (NCSC), said manufacturers needed to do more to secure connected devices.
“There’s a lot we need to ask big technology companies to do to provide safer devices and products in the first place,” he said.
Martin advised consumers to keep their devices updated and to enable multi-factor authentication whenever possible.
“I know it hurts, but it only takes a few seconds,” he said.
From April 2024, UK law will require manufacturers of certain consumer smart devices to meet minimum cybersecurity standards, including requirements covering passwords and security updates.
Publicly accessible retail systems raise concerns
The NCSC said it was working with international partners and the industry to understand the supermarket incident, but said it was not aware of any impact on the UK.
However, researchers at UK Cyber Defense identified more than 800 refrigeration and building-management interfaces connected to UK retailers that were accessible via the public internet.
Public access does not necessarily mean those systems can be hacked, but it can expose them to attackers seeking to exploit weak passwords or software vulnerabilities.
The government is already holding talks with food-retailer executives about cyber resilience following previous attacks on supermarkets.
Helen Dickinson, chief executive of the UK Retail Consortium, said cyber incidents were a major concern for retailers. She added that businesses were working with the NCSC to share information and strengthen their defences.
Previous supermarket attacks affected food supplies
This is not the first cyberattack to raise concerns about the potential impact on food supplies.
When UK supermarkets M&S and Co-op were targeted by ransomware hackers in May 2025, the retailers struggled to stock some stores with fresh produce. In the days that followed, customers across the UK reported empty shelves.
Who is responsible for securing connected equipment?
Tom Hagel, a researcher at cybersecurity firm Sentinel One, said retailers needed to be more transparent about their responsibilities.
“What retailers need to answer is not who will do the repairs, but who owns the security of the equipment,” he said.
Hagel said internet connectivity could make everyday technology more convenient, but security needed to keep pace.
“Once an attacker is able to manipulate these controls, a legitimate function such as unzipping becomes a disruptive tool,” he said.
“Changing settings not only disrupts your computer system, but can also destroy your physical inventory.”
Source: www.bbc.co.uk