The key facts
- Supermarkets in seven European countries were affected by an alleged cyberattack on refrigeration equipment
- The NCSC is not aware of any impact on the UK, but researchers found more than 800 internet-accessible interfaces of refrigeration systems belonging to British retailers
- Since 2024, the UK has had a law setting minimum cybersecurity standards for consumer smart devices
What happened
Supermarkets in seven European countries were affected by an alleged cyberattack targeting their refrigerators and freezers. The incident raised questions about the vulnerability of internet-connected equipment — from industrial machinery to household appliances, BBC News reports. Smart devices — refrigerators, heating systems, washing machines — are convenient for remote control, but in theory any device with an internet connection could become a target for attackers. At the same time, as the outlet notes, this does not mean they are easy to hack: major manufacturers usually pay close attention to security.
The UK context and previous attacks on retail
The UK's National Cyber Security Centre (NCSC) said it is working with international partners and industry to establish the circumstances of the incidents, but is not aware of any impact on the UK. Nevertheless, researchers at UK Cyber Defence identified more than 800 interfaces for refrigeration and building management equipment linked to British retailers and accessible via the public internet. This does not necessarily mean they can be hacked, but they may be vulnerable to attacks through weak passwords or software flaws. The government had already held talks with major grocery retailers on cyber resilience after earlier attacks on supermarkets: in May 2025, when M&S and Co-op fell victim to ransomware, stores struggled to stock fresh deliveries, and shoppers across the country complained of empty shelves. There are no cases in which household appliances specifically were the target of the November attacks on supermarkets.
Risks beyond the shops
Experts point out that connected equipment is used far beyond retail. Cybersecurity specialist Ken Munro recalled a 2015 demonstration in which researchers remotely hacked a Jeep through its internet-connected entertainment system, which pushed the automotive industry to improve security. According to him, mobile connections are widely used to monitor equipment at power plants and water networks; British utility companies generally protect such connections well, but standards vary around the world, and his main concern is small, poorly funded companies with old, vulnerable equipment. Olivier Daloy of Zscaler believes that without proper protection, 'any factory or equipment' connected to the internet could pose similar risks — from car manufacturers to energy and transport infrastructure. SentinelOne researcher Tom Hegel stressed that retailers need to define responsibility more clearly: 'The question retailers need to answer is who is responsible for the security of this equipment, not just who repairs it,' and noted that legitimate functions such as defrosting become tools of disruption, and changing a setting could destroy physical stock rather than merely interrupt a computer system. Former NCSC head Ciaran Martin called on manufacturers to make devices more secure from the start, and urged consumers to update their devices and enable multi-factor authentication. Since April 2024, UK law has required manufacturers of a range of consumer smart devices to meet minimum cybersecurity standards, including requirements for passwords and security updates.
Image source, Getty Images 
