Hackers Can Take Control of a Supermarket Freezer—How Vulnerable Is Connected Tech?

Refrigeration systems exposed

The suspected attack on supermarket fridges and freezers highlights the risks of equipment that can be managed through internet connections. Researchers from UK Cyber Defence found over 800 refrigeration and building-control interfaces associated with British retailers that are accessible on the public internet.

A connected system may let someone operate equipment from a distance. Ciaran Martin, former head of the UK's National Cyber Security Centre, said retailers must clarify who is responsible for securing such equipment, beyond the party that repairs it.

Martin said ordinary features such as defrosting could be misused to cause disruption if an attacker gained access to the controls. Customers across the UK reported empty shelves in the days after the attack.

Security duties and protections

The UK government has discussed cyber resilience with senior food retailers after previous attacks on supermarkets. The article does not specify which earlier incident led to the reported empty shelves.

Since April 2024, UK law has required makers of certain consumer smart devices to meet minimum cybersecurity requirements. These include provisions concerning passwords and security updates. Martin urged consumers to install updates and use multi-factor authentication when available. In 2015, researchers showed that a weakness in a Samsung smart fridge could expose internet traffic to interception.

Risks reach beyond shops

Internet-connected technology also manages industrial machinery and vehicles, extending the potential consequences beyond household appliances and supermarkets. Olivier Daloy, a cybersecurity expert at Zscaler, warned that connected factories and equipment could face similar dangers without suitable safeguards.

Munro said UK utilities were generally effective at protecting these connections, but standards differed internationally. He also said the vehicle industry had addressed an earlier problem. The incidents raise concerns about possible effects on food supplies, as well as other connected infrastructure. The article does not give details about the suspected attack's method or identify who was responsible.