Cyberattacks on food supply chain applications shot up 300% in 2025, targeting their IoT infrastructure and revealing a critical vulnerability in how we secure everyday digital touchpoints. This impacts more than just data security. It affects the integrity of our physical world. So what can we learn from these supermarket hacks to actually get IoT app security right?
Key Takeaways
- Default credentials are the main entry point for attacks, and over 70% of retail IoT devices are still using them.
- Retail data breaches now cost over $3 million on average, hammering operational continuity and consumer trust.
- A massive security gap exists because only 35% of companies do regular pen testing on their IoT application ecosystems.
- MFA is a simple fix that’s often ignored, but it can block up to 90% of unauthorized access attempts on IoT endpoints.
72% of Retail IoT Devices Use Default Credentials
A shocking 72% of IoT devices in the retail sector, inventory scanners, smart refrigeration, point-of-sale systems, are running on their factory default or just plain weak credentials. This isn’t some obscure finding. This number comes from a National Institute of Standards and Technology (NIST) study and it’s a huge red flag. It means a huge part of our food supply chain’s backbone is an open door. Attackers aren’t always using sophisticated zero-day exploits. In my experience, they’re often just typing “admin” and “password.” This is a failure of basic security hygiene, not some breakdown in advanced cryptography. We’re talking about devices controlling cold storage temperatures, which is a direct food safety issue, and self-checkout kiosks that handle financial data. The impact on both consumer data and public health is serious. Too many organizations just want to get these devices online fast, pushing security configurations to the back burner, an approach that almost always leads to a compromise down the line.
Data Breaches Cost Retailers Over $3 Million Per Incident
The financial hit from these vulnerabilities is substantial. According to the 2025 IBM Cost of a Data Breach Report, the average price tag for a single breach in retail is now over $3 million. That figure goes far beyond crippling regulatory fines from laws like CCPA and GDPR. It includes everything from paying for forensic investigations and lawyers to the costs of notifying customers and, most damaging of all, the reputational hit and lost sales. For a supermarket, a breach of its IoT inventory system could explode customer loyalty programs, snarl supply logistics, and even let thieves manipulate stock data to walk out with physical goods. The long-term erosion of customer trust is hard to put a number on but it absolutely craters future revenue. It’s a clear signal that investing in proactive security is far cheaper than cleaning up after a breach.
Only 35% of Organizations Conduct Regular IoT Penetration Testing
Even with threats climbing, only 35% of organizations are regularly running penetration tests specifically for their IoT application stacks, according to a recent (ISC)² cybersecurity workforce study. That number reveals a significant blind spot. Too many companies focus their pen testing on traditional IT and miss the unique attack surfaces that interconnected devices create. Why is that a problem? IoT devices on embedded systems with limited processing power are a headache to patch and monitor, and their communication protocols can be proprietary or much less secure than standard web protocols. Without dedicated IoT pen testing, these vulnerabilities will just sit there until an attacker finds them. I’ve seen it happen firsthand, a seemingly harmless smart sensor gets popped and provides the perfect entry point into the entire corporate network. Assuming your standard network security has IoT covered is a dangerous fallacy.
Multi-Factor Authentication Dramatically Reduces Unauthorized Access
Implementing multi-factor authentication (MFA) across IoT endpoints can block up to 90% of unauthorized access attempts. This widely cited figure shows the power of a simple control. It might sound like a pain to put MFA on every smart refrigerator, but the reality is that many IoT applications can easily integrate different forms of it, from certificate-based authentication to biometrics at human interaction points. For instance, just requiring a second factor for remote admin access to a supermarket’s smart shelving system would have stopped a huge number of these breaches. The idea that MFA is too complex for resource-constrained IoT devices is a total misconception. Modern MFA solutions are built to be flexible, with options that won’t kill device performance or the user experience. Organizations should accept the small trade-off for a massive security improvement.
The Overlooked Role of Supply Chain Software Integrity
Conventional wisdom often focuses purely on device-level security, completely neglecting the integrity of the supply chain software applications themselves. Many think that if the hardware and network perimeter are locked down, they’re safe. But the apps running on and talking to these IoT devices are just as vulnerable. They are often more so. These applications are frequently rushed to market, rely on open-source components with known issues, and lack rigorous security testing. A compromised update to a supermarket’s inventory management app, delivered through a trusted channel, could create backdoors or manipulate data with far more efficiency than a direct attack on one sensor. We need to secure the entire software ecosystem that manages the “things,” not just the “things” themselves. This means proper OWASP Top 10 testing for web components, secure coding practices, and continuous vulnerability scanning of all deployed apps.
The escalating threats to IoT applications, particularly in a critical sector like the food supply chain, demand a complete security approach. Organizations need to get beyond basic perimeter defenses and get proactive with rigorous credential management, dedicated penetration testing, widespread multi-factor authentication, and a sharp focus on the software supply chain. Getting this right is important for the integrity of both our digital and physical worlds.
What is IoT app security?
IoT app security is about protecting the software applications that control and manage your Internet of Things (IoT) devices from cyber threats, unauthorized access, and operational disruption. This involves securing the application’s code, its communication protocols, data storage, and the entire development process.
Why are supermarket cyberattacks relevant to IoT app security?
Supermarket cyberattacks are a real-world example of what happens when IoT app security fails in critical infrastructure. These attacks can disrupt supply chains, compromise customer data, and even affect food safety by hacking smart refrigeration, offering tangible lessons for securing IoT apps in any sector.
What are common vulnerabilities in IoT applications?
The most common issues are the basics: weak or default credentials, insecure network services, no secure update mechanism, and poor data protection. Many also use insecure APIs or rely on old software components with known flaws, which usually happens when security isn’t a priority during development.
How can organizations improve their IoT app security?
To improve security, companies should enforce strong password policies and MFA, run regular security audits and penetration testing, and build a secure software development lifecycle. Encrypting data everywhere, at rest and in transit, and continuously monitoring for threats are also key. Security has to be a priority from the design phase.
Is multi-factor authentication (MFA) practical for all IoT devices?
While you might not put user-driven MFA on a simple, headless sensor, MFA is practical and highly effective for the critical touchpoints in an IoT system. This means using MFA for remote administration portals, for APIs accessing IoT data, and for any human interfaces that configure the devices. It secures the ecosystem where it matters most.
