Supermarkets across Europe have been affected by suspected cyber-attacks targeting refrigerators and freezers, raising wider questions about the security of internet-connected hardware. Smart devices can include household appliances, heating systems and industrial equipment, all of which may be managed remotely when connected to the internet.
Internet access does not automatically mean that a device can be easily taken over. Major manufacturers generally invest heavily in security, although vulnerabilities have been found in connected products before. In 2015, researchers demonstrated that a flaw in a Samsung smart fridge could allow internet traffic to be intercepted.
There is no evidence that domestic appliances were targeted in the supermarket incidents. However, Ciaran Martin, former chief executive of the UK's National Cyber Security Centre, said manufacturers needed to do more to build security into connected products. He advised consumers to install updates and activate multi-factor authentication where available.
UK legislation introduced in April 2024 requires manufacturers of certain consumer smart devices to meet minimum cybersecurity standards, including rules covering passwords and security updates. The NCSC said it was working with international partners and industry to understand the supermarket incidents and was not aware of any impact on the UK.
Researchers from UK Cyber Defence have identified more than 800 refrigeration and building-control interfaces linked to British retailers that can be accessed over the public internet. Public accessibility does not necessarily mean the systems can be hacked, but weak passwords or software vulnerabilities could increase their exposure to attackers.
The incidents have also focused attention on who is responsible for securing equipment used by retailers. Tom Hegel of SentinelOne said businesses needed to establish who owns the security of such systems, rather than simply who repairs them. He warned that changing a control setting could damage physical stock, turning an ordinary function such as defrosting into a method of disruption.
The potential risks extend beyond shops and homes. Connected technology is used to manage vehicles, industrial machinery, power plants and water networks. Cybersecurity expert Ken Munro cited a 2015 demonstration in which researchers remotely accessed a Jeep through its internet-connected entertainment system, prompting improvements in vehicle security.
Munro said UK utilities were generally effective at protecting remote connections, although standards varied internationally. He identified smaller, poorly funded utility companies that may still rely on older equipment as a particular concern. Olivier Daloy of Zscaler said that without suitable protections, any internet-connected factory or infrastructure, including systems operated by carmakers, electricity providers or transport networks, could face comparable risks.
Sources: BBC News World.