If Hackers Can Take Control of a Supermarket Freezer, How Vulnerable Is Other Tech?

Dozens of shops in several European countries have been hit by a suspected cyber-attack that reached into their fridges and freezers. The incidents, which took place in November, have prompted a broader question about how exposed internet-connected hardware really is, from industrial machinery down to ordinary household appliances.

The worry rests on a simple trade-off. Smart devices, a category that includes fridges, central heating and even washing machines, can be controlled remotely because they are online. But in theory, anything that goes online can be exploited by malicious actors. That does not mean hackers can easily take control of any given device, and big brands generally go to great lengths to keep their products secure. There is also no evidence that domestic appliances were targeted in the supermarket attacks.

Exploits have surfaced before, though. In 2015, researchers showed that a vulnerability in a Samsung smart fridge could let them intercept internet traffic. Ciaran Martin, the former chief executive of the UK's National Cyber Security Centre (NCSC), says manufacturers need to do more. "There's a lot more that we need to demand of big tech to give us safer devices and products in the first place," he said. For consumers, he advised keeping devices updated and switching on multi-factor authentication wherever possible. "I know it's a pain, but it only takes a few seconds," he said.

Since April 2024, UK law has required makers of certain consumer smart devices to meet minimum cyber security standards, including rules on passwords and security updates.

The NCSC said it was working with international partners and industry to understand the supermarket incidents, and that it knew of no impact on the UK. Still, researchers at UK Cyber Defence have identified more than 800 refrigeration and building-control interfaces linked to British retailers that can be reached over the public internet. That does not necessarily mean they can be hacked, but it could leave them open to attackers who exploit weak passwords or software flaws. The government has already held talks with senior food retailers about cyber resilience, following earlier attacks on supermarkets. Helen Dickinson, chief executive of the British Retail Consortium, has said cyber incidents are a major concern for retailers, who are working with the NCSC to share intelligence and strengthen defences.

Concern about food supply is not new. When M&S and the Co-op were hit by ransomware in May 2025, the retailers struggled to get fresh deliveries onto some shelves, and customers across the UK complained of empty shelves in the following days.

Tom Hegel, a researcher at the security firm SentinelOne, argues that retailers must be clearer about responsibility. "The question retailers need to answer is who owns the security of that equipment, not just who repairs it," he said. He added that once an attacker can operate the controls, functions such as defrosting become tools for disruption. "Changing a setting can destroy physical stock, not just interrupt a computer system," he said.

The questions extend beyond shops. Connected technology is used to manage industrial machinery and vehicles remotely. Cyber security expert Ken Munro pointed to the 2015 demonstration in which researchers remotely hacked a Jeep through its internet-connected entertainment system, which led to improvements in vehicle security. "Fortunately, the vehicle industry woke up to this and fixed the problem," he said. Mobile connections are also widely used to monitor equipment in power plants and water networks. Munro said UK utilities are generally good at securing them, though standards vary around the world, and his biggest concern is smaller, poorly funded utilities that may still rely on older, vulnerable equipment.

Olivier Daloy, a cybersecurity expert at Zscaler, said that without proper protections, any factory or equipment connected to the internet, from carmakers to electricity or transport infrastructure, could face similar risks. What to watch next is who is held responsible for securing such equipment, and whether smaller utilities and industrial systems turn out to be as exposed.