If hackers can take control of a supermarket freezer, how vulnerable is other tech? — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Supermarkets across seven European countries were hit by a suspected cyber-attack affecting their fridges and freezers in November, but there is no evidence domestic appliances were targeted in those attacks.
- NCSC said it was working with international partners and industry to understand the supermarket incidents but was unaware of any impact on the UK.
- UK Cyber Defence identified more than 800 refrigeration and building-control interfaces associated with British retailers that can be accessed over the public internet, which does not necessarily mean they can be hacked but leaves them exposed to attackers exploiting weak passwords or software vulnerabilities.
- Consumer smart devices in the UK have been required to meet minimum cyber security standards since April 2024, including requirements around passwords and security updates; Ciaran Martin said manufacturers needed to do more and advised consumers to update devices and enable multi-factor authentication.
- M&S and the Co-op were targeted by ransomware hackers in May 2025 and struggled to stock some shelves with fresh deliveries, with customers complaining of empty shelves in the days following the attack.
- Tom Hegel of SentinelOne said retailers need to answer who owns the security of that equipment, not just who repairs it, warning that once attackers operate the controls, legitimate functions such as defrosting become tools for disruption that can destroy physical stock, not just interrupt a computer system.
- Ken Munro said UK utilities are generally good at securing the mobile connections used to monitor power plants and water networks, but his biggest concern is smaller, poorly funded utilities still relying on older, vulnerable equipment; a 2015 demonstration in which researchers remotely hacked a Jeep prompted improvements in vehicle security.
Why it matters: For retailers, the exposure is physical rather than purely digital: more than 800 internet-reachable refrigeration and building-control interfaces sit behind UK cold chains, and the May 2025 M&S and Co-op ransomware attacks already emptied shelves. Hegel's question, who owns the security of the equipment rather than just who repairs it, leaves accountability for spoiled stock unresolved.
Ask SkimNews
