Supermarket freezer hack raises fears for internet-connected tech

A suspected cyber-attack that hit supermarkets across Europe and affected fridges and freezers has sparked fresh worries about the safety of internet-connected hardware. From industrial machinery to domestic appliances, smart devices are now part of daily life. But the incident shows how these systems can be turned against their owners.

Growing attack surface

Researchers from UK Cyber Defence found over 800 refrigeration and building-control interfaces tied to British retailers that were reachable over the public internet. That doesn’t mean they were all hackable, but weak passwords or software flaws could leave them open to attackers. And it’s not just shops—connected tech is used to run industrial machines and vehicles remotely.

Cyber security expert Ken Munro recalled a 2015 demo where researchers took over a Jeep through its internet-linked entertainment system. That prompted car makers to boost security. Mobile connections also let engineers watch equipment in power plants and water networks from afar. Munro said UK utilities are mostly good at protecting these links, but standards differ worldwide. He worries most about smaller, cash-strapped utility firms that might rely on old, vulnerable gear.

Retailers under pressure

In May 2025, UK supermarkets M&S and Co-op were hit by ransomware. Shelves went empty as fresh deliveries stalled, and customers complained for days. Tom Hegel, a researcher at SentinelOne, said retailers must decide who owns the security of their equipment, not just who fixes it. “Once an attacker can operate those controls, legitimate functions such as defrosting become tools for disruption,” he said. “Changing a setting can destroy physical stock, not just interrupt a computer system.” The government has talked with senior food retailers about cyber resilience after earlier attacks. Helen Dickinson, chief executive of the British Retail Consortium, said cyber incidents are a major concern, and businesses are working with the NCSC to share intelligence and strengthen defences.

What can be done?

Ciaran Martin, former chief executive of the UK’s National Cyber Security Centre, said more must be demanded of big tech to deliver safer devices from the start. He advised consumers to keep devices updated and turn on multi-factor authentication where possible. “I know it’s a pain, but it only takes a few seconds,” he said.

Since April 2024, UK law has required makers of certain consumer smart devices to meet minimum cyber security standards, including rules on passwords and security updates. The NCSC is working with international partners and industry to understand the supermarket incidents, but said it’s unaware of any impact on the UK. Olivier Daloy, a cybersecurity expert at Zscaler, warned that without proper protections, any factory or equipment connected to the internet—from carmakers to electricity or transport infrastructure—could face similar risks.