Researchers at UK Cyber Defence have found more than 800 refrigeration and building-control systems tied to British retailers that anyone can reach over the open internet, a finding that lands as supermarkets elsewhere in Europe deal with a suspected cyberattack on their fridges and freezers.
Being visible online does not mean those systems can be broken into, the researchers noted. But weak passwords or unpatched software could hand intruders a way in.
The UK's National Cyber Security Centre said it had seen no effect on Britain from the European incidents. The agency is cooperating with foreign counterparts and companies to piece together what happened.
Stock at risk, not just systems
For retailers, the danger goes beyond a computer outage. Tom Hegel, a researcher at security firm SentinelOne, warned that an attacker who seizes these controls can turn routine features such as defrosting into tools of sabotage, spoiling physical inventory.
Hegel said chains need a clear answer on who is responsible for securing the equipment, not merely who fixes it when it breaks.
Changing a setting can destroy physical stock, not just interrupt a computer system.
Tom Hegel, researcher at SentinelOne
British grocers already know the cost of a breach. After ransomware hackers hit M&S and the Co-op in May 2025, the two chains had trouble getting fresh deliveries onto shelves, and shoppers nationwide complained of empty aisles for days.
The government has met with senior food retail executives on cyber resilience following those earlier attacks. Helen Dickinson, who leads the British Retail Consortium, has called cyber incidents a major worry for the industry and said firms are trading intelligence with the security agency to harden their defenses.
Pressure on device makers
Ciaran Martin, a former chief executive of the National Cyber Security Centre, said manufacturers must do more to build secure connected products. He told consumers to keep devices updated and switch on multi-factor authentication where they can.
There's a lot more that we need to demand of big tech to give us safer devices and products in the first place,
Ciaran Martin, former chief executive of the National Cyber Security Centre
UK law has, since April 2024, required makers of certain consumer smart devices to meet baseline security rules covering passwords and updates. There is no sign household appliances were targeted in the November supermarket attacks, though researchers showed in 2015 that a flaw in a Samsung smart fridge could let them intercept internet traffic.
Beyond the supermarket aisle
Security expert Ken Munro recalled another 2015 case, when researchers took remote control of a Jeep by way of its connected entertainment system, an episode that pushed carmakers to improve protections.
Munro said British utilities generally guard their remote monitoring links well, though standards differ globally. His chief worry is smaller, cash-strapped utilities that may still run older, vulnerable gear.
Olivier Daloy, a cybersecurity expert at Zscaler, said any internet-linked factory or equipment, from auto plants to power and transport networks, could face similar threats without proper safeguards.
