European supermarket cyber-attack highlights risks of connected industrial hardware

A suspected cyber-attack affecting refrigeration and freezer systems in supermarkets across Europe has intensified scrutiny regarding the security of internet-connected hardware. The incident has raised significant concerns about the potential vulnerabilities of devices ranging from large-scale industrial machinery to domestic appliances. While smart devices such as fridges, central heating units, and washing machines offer the convenience of remote control, their online connectivity theoretically exposes them to exploitation by malicious actors. However, experts note that such access does not imply easy control, as major manufacturers generally implement substantial measures to secure their technology. There is currently no evidence that domestic appliances were specifically targeted in the November attacks on supermarket infrastructure.

Ciaran Martin, the former chief executive of the UK’s National Cyber Security Centre, has called for manufacturers to do more to ensure the security of connected devices. He emphasised the need to demand safer products from large technology companies. Martin advised consumers to keep their devices updated and to enable multi-factor authentication wherever possible, noting that while this may be inconvenient, it is a quick and necessary step. Since April 2024, UK legislation has required manufacturers of certain consumer smart devices to meet minimum cyber security standards, including specific requirements regarding passwords and security updates. The NCSC stated that it is collaborating with international partners and industry stakeholders to understand the supermarket incidents, although it is unaware of any direct impact on the UK.

Despite the lack of confirmed domestic impact, researchers from UK Cyber Defence have identified more than 800 refrigeration and building-control interfaces associated with British retailers that are accessible over the public internet. While this does not confirm that these systems have been hacked, it suggests they may be exposed to attackers exploiting weak passwords or software vulnerabilities. The government has held discussions with senior food retailers regarding cyber resilience following previous attacks. Helen Dickinson, chief executive of the British Retail Consortium, described cyber incidents as a major concern for the sector. She noted that businesses are working alongside the NCSC to share intelligence and strengthen their defences.

The potential for cyber-attacks to disrupt food supplies is not new. In May 2025, UK supermarkets M&S and the Co-op were targeted by ransomware hackers, leading to difficulties in stocking fresh deliveries and resulting in empty shelves for customers. Tom Hegel, a researcher at SentinelOne, argued that retailers must be clearer about responsibility for equipment security. He stated that once an attacker can operate controls, legitimate functions such as defrosting can become tools for disruption, potentially destroying physical stock rather than just interrupting computer systems.

Beyond the retail sector, connected technology is used to manage industrial machinery and vehicles. Ken Munro, a cyber security expert, referenced a 2015 demonstration where researchers remotely hacked a Jeep through its entertainment system, which subsequently prompted improvements in vehicle security. He noted that the vehicle industry addressed this issue. Mobile connections are also widely used to monitor equipment in power plants and water networks. While UK utilities are generally good at securing these connections, standards vary globally. Munro expressed concern for smaller, poorly funded utility companies that may rely on older, vulnerable equipment. Olivier Daloy, a cybersecurity expert at Zscaler, warned that without proper protections, any internet-connected factory or equipment, from carmakers to transport infrastructure, could face similar risks.