A suspected cyberattack has affected supermarkets across Europe, targeting their fridges and freezers. This incident has raised concerns about the vulnerabilities of internet-connected hardware, from industrial machinery to domestic appliances. Smart devices connected to the internet include fridges, central heating, and washing machines, making them easier to control remotely but also potentially exploitable by malicious actors.
While big brands generally take great lengths to secure their technology, exploits have been found in some devices. In 2015, researchers demonstrated a vulnerability in a Samsung smart fridge that could allow them to intercept internet traffic. However, there's no evidence that domestic appliances are being targeted in these cyberattacks on supermarkets.
Ciaran Martin, former chief executive of the UK's National Cyber Security Centre (NCSC), emphasizes that manufacturers need to do more to make connected devices secure. He advises consumers to keep devices updated and enable multi-factor authentication wherever possible. Since April 2024, UK law has required manufacturers of certain consumer smart devices to meet minimum cyber security standards.
The NCSC is working with international partners and industry to understand the supermarket incidents but is unaware of any impact on the UK. Researchers from UK Cyber Defence have identified over 800 refrigeration and building-control interfaces associated with British retailers that can be accessed over the public internet, potentially leaving them exposed to attackers.
The UK government has already held talks with senior food retailers about cyber resilience, following earlier attacks on supermarkets. Helen Dickinson, chief executive of the British Retail Consortium, notes that cyber incidents are a major concern for retailers, who are working alongside the NCSC to share intelligence and strengthen their defenses.
Experts stress that retailers must be clearer about responsibility for equipment security. Tom Hegel, a researcher at SentinelOne, says internet connectivity can make everyday technology more convenient, but security needs to keep pace. Olivier Daloy, a cybersecurity expert at Zscaler, warns that any factory or equipment connected to the internet, from carmakers to electricity or transport infrastructure, could face similar risks.
Cybersecurity experts point to previous demonstrations of vulnerabilities in connected devices, such as a 2015 demonstration in which researchers remotely hacked a Jeep through its internet-connected entertainment system. Ken Munro notes that standards vary around the world, and his biggest concern is smaller, poorly funded utility companies that may still be relying on older, vulnerable equipment.
Key points
- The cyberattack on European supermarkets highlights the need for manufacturers to prioritize the security of internet-connected devices.
- Experts advise consumers to keep devices updated and enable multi-factor authentication to minimize vulnerabilities.
- The incident raises concerns about the potential risks to other critical infrastructure, such as power plants and water supplies.
