Can a Smart Meter Be Hacked? Security of the Smart Metering System

No system connected to a network can be called impossible to attack, but the smart metering system in Great Britain was built to make it very hard. It was designed in partnership with cyber security experts to prevent hacking as much as possible, and meter data is encrypted to stop hackers reaching your information¹. The national network uses two layers of encryption and was designed with security at its core alongside the National Cyber Security Centre (NCSC), part of GCHQ².

Just as important is what a smart meter does not do. It uses a closed, dedicated communications system rather than the internet, and it does not store your name, address or bank details³. Security experts monitor the network 24/7, carrying out around 1,500 checks a day⁴. So even a successful attack on a single meter would expose energy readings rather than identity or bank details, and the network is watched continuously for exactly that kind of attempt.

For a household thinking about energy independence, the security picture cuts both ways. A smart meter ties the home more closely to a supplier and to a national network run by one licensed company, and some functions depend on that connection working. Strict rules protect against a supplier switching off supply, and those protections are as strong with a smart meter as with a traditional one³. The weaker points tend to sit not in the meter but in the apps, hubs and wifi gadgets a household adds around it.

Designed to make hacking very hard, not to be unhackable

The claim made for the system is careful: it was designed "to prevent hacking as much as possible"¹. That is not a promise that no attack could ever succeed, and it is worth reading as the engineering aim it is. What the design does is limit how far any breach could reach and how useful anything taken would be.

Three features do most of that work. First, the readings travel over a dedicated network rather than the public internet, which removes the most common route by which home devices are attacked³. Second, the data is encrypted twice². Third, the meter itself holds only energy use and tariff information; GCHQ and the NCSC lead the security process that all smart meters must go through, and a meter does not share information that could identify you⁷.

A smart meter can also only measure energy use. It is not a camera, a microphone or a general purpose computer. The in-home display talks to the meter over the Home Area Network, which is itself a secure network¹.

The practical outcome for a household is that the thing an attacker would most want, personal and financial data, is not on the meter or carried by it. What remains sensitive is the energy reading itself, since half-hourly use can show when a home is occupied. That is why the rules on who can see the data (covered below) matter as much as the encryption does.

How the security is built: encryption, GCHQ processes and closed networks

The security architecture has several layers, and each comes from an official or independent source rather than a manufacturer's claim.

The two layers of encryption are the centrepiece. The DCC describes the data as "securely wrapped" in two layers before a communications hub creates a home area network in the property⁹. The network, it states, "operates entirely separately from the potential pitfalls of the public internet"¹¹.

Independent guidance describes the whole system as designed by top cyber security experts¹³, and meters as designed with experts including the government and GCHQ¹⁰. The Centre for Sustainable Energy frames the protection the same way, as a security process designed by GCHQ, "the UK government's intelligence, security, and cyber agency"⁸.

What this means in practice is that a household's broadband, router and wifi password play no part in the meter's own security. A compromised home network does not give an attacker a route to the meter's readings over the national network. The dependence that remains is on the design choices of central bodies: the security of the whole system rests on the DCC and the government's security agencies, not on anything the householder controls. For more on the radio links involved, see how smart meters communicate.

The DCC runs the national network your meter talks over

The Data Communications Company (DCC) is licensed to operate the national communications network for smart metering¹⁴, and it operates the secure national network that connects smart meters across Great Britain¹⁵. Every reading a smart meter sends to a supplier or to the in-home display uses this network¹⁶, and all readings are sent automatically over it to the supplier¹⁷.

Physically, readings leave the home through a communications hub, which also creates the home area network, and travel to a wide area network made up of mobile phone or radio masts⁹. The DCC states that millions of meters are connected⁹. Through this network, data can be shared securely between authorised users to support smart energy services¹⁵.

Security is monitored centrally: at the DCC's headquarters, experts watch the network around the clock and carry out around 1,500 daily checks⁴. The network also carries a firmware service that allows remote upgrades of meters, unlocking new functions as they are developed⁹. Remote upgrade is a double-edged capability: it lets weaknesses be fixed without a visit, but it also means the meter's behaviour can change after installation without the householder doing anything.

The network's own resilience is being renewed. The DCC's 4G communications hubs are to be supported by Vodafone's network, which it states can provide services for many years¹⁸. Some DCC incident management cases are covered by a 90-day Service Level Agreement¹⁹.

On data, the DCC describes itself as a custodian: "As custodians of smart meter data, we are underpinned by a clear consumer consent capability"²⁰. It also says it is working with the regulator on how consent can be enhanced and improved for consumers²⁰, an acknowledgement that the consent arrangements are still being refined.

For independence, the DCC is a single point of dependence. The meter's smart functions rely on one licensed operator and, through it, on commercial mobile networks. More on the company itself is on the page about the Data Communications Company.

What data leaves your meter, who sees it and the legal protections

A smart meter gives data only about how much energy is used, and that data is protected by law²¹. The only information a meter holds is energy used and the tariff; it holds nothing that could identify the household, such as a name or address²². Personal details are neither stored on the meter nor transmitted by it²³.

Who can see the readings

The starting position is that only the household and its energy supplier can access the data smart meters share²². The government's statement of rights puts it as a matter of control:

The exception is regulated purposes such as billing²⁵. Ofgem lists three uses of the data: billing for the energy used; offering new products and services such as tariffs, if permission has been given; and helping the energy system run more efficiently by recording demand more accurately²⁶.

The frequency of readings is also the household's choice: half-hourly, daily or in some cases monthly, and the preference can be changed at any time³. Network operators can obtain data recorded at 30 minute intervals, aggregated and anonymised²⁸.

Consent and ownership

Smart meter data is classified as personal data owned by the consumer, and the consumer is the source of consent for any onward sharing²⁷. If a supplier needs to share data with a third party, the household is notified and can opt out¹, and a supplier cannot share it with anyone else without asking first⁸. Suppliers cannot use the data for sales or marketing without permission¹.

These are legal protections rather than technical ones: they depend on suppliers and third parties following the rules, and on the regulator enforcing them. Detail is on the pages about smart meter data and smart meter data consent.

SMETS and the security standards your meter must meet

Smart meters in the rollout comply with the Smart Meter Equipment Technical Specification, known as SMETS²⁹. There are two generations, and the difference matters for how dependable the smart functions are.

Some SMETS1 meters could lose smart functionality when a consumer switched supplier³⁰, and they may stop sending data to the new supplier, leaving manual readings³¹. SMETS2 meters were designed to connect directly to the DCC's secure national network³⁰ and are fully compatible with it³¹. The DCC has a programme to upgrade first-generation meters³⁰. See SMETS1 and SMETS2 meters for the full comparison.

Safety standards

Separate from the specification, all smart meters are covered by strict UK product safety laws, giving the same quality and safety standards whichever supplier installs them²³. They comply with UK and EU safety standards²⁴, and must comply with Great Britain's safety legislation before installation⁷. Meters in the national rollout follow UK and EU product safety legislation, including the correct use of radio equipment and emissions²².

How SMETS feeds into the rules

The SMETS label also defines which meters fall under consumer protections. Ofgem's Guaranteed Standards of Performance for smart meters apply to SMETS compliant meters only, as set out in the Smart Energy Code; respondents had asked for the definition to be clarified because a reference to the Electricity and Gas Acts could otherwise have taken in advanced metering³². More on this is on the smart meter standards and accuracy and smart meter guaranteed standards pages.

Where the real risks sit: devices added around the meter

The meter and the national network are the most heavily assured parts of the picture. The less assured parts are what a household connects around them.

Ofgem noted in 2014 that the technology suppliers used to connect meters and in-home displays could compromise the provision of a SMETS compliant home area network, and that consumers could have difficulty connecting Consumer Access Devices to the system³³. Those are old findings, but they identify where friction and risk sit: the edge of the network, inside the home.

Smart meters are independent of smart heating controls, though combining the two can improve remote management of heating and energy³⁴. Smart thermostats such as Hive and Nest connect to home wifi so heating and hot water can be controlled by phone, tablet or computer³⁵. The DCC also describes smart meters as integrating with smart home systems for automated adjustments³⁶. Once a household adds these devices, it has devices on its own broadband, often linked to a maker's cloud service and app, which sit outside the GCHQ-led assurance process for meters.

The consent rule gives one safeguard: an app that reads meter data needs the household's permission to access it¹. But the security of the app, its account and the maker's servers is a separate question from the security of the meter.

Everyday reliability is a more common problem than hacking. In July 2024, 35% of households with a smart meter reported an issue with it in the last three months⁶, consistent with 35% in Ofgem's interim wave³⁷ and slightly below the 37% reported for the period to September 2023³⁸. These surveys count any issue, not security incidents.

Rules for the connected devices themselves, including minimum security requirements for products sold in the UK, are covered on the page about the PSTI regime for connected devices. Related pages cover consumer access devices, app subscriptions and cloud dependence and keeping energy data in the home.

Remote disconnection, safety and what else the system does

A frequent worry is that a remote switch could let someone, a supplier or an attacker, cut a home's supply. The regulatory protection is clear: strict regulations protect against a supplier switching off or disconnecting gas or electricity, and that protection remains as strong with a smart meter as with a traditional one³. The system also does more than billing.

• Safety checks at installation: checks carried out during installation can find other unsafe situations unrelated to smart meters¹³.
• Fire risk: described as very low; it is "incredibly rare" for a meter to be faulty and rarer still for there to be a fire⁷.
• Health: Public Health England sees no risk to health, and radio exposure is many times lower than from wifi and mobile phones¹⁰. Exposure is much lower than from other electronic appliances²³.
• Product testing: according to DESNZ, smart meters are subject to the same safety regulations and testing as other in-home devices, including baby monitors and mobile phones³¹.
• Tariffs: a smart meter can give access to more flexible tariffs, including dual-rate tariffs²⁶.

Ofgem has also said, in a 2015 consultation, that safety obligations and enhanced theft detection and billing accuracy obligations protect consumers with both traditional and smart meters more effectively than the older inspection obligation³⁹.

When the network cannot reach the meter

A smart meter depends on its connection to deliver smart functions. Ofgem lists the causes of a meter not operating in smart mode: it loses connection with the supplier; it loses connection after a change of supplier; or it was installed without being connected to the national communication system⁴⁰. The meter continues to measure energy, but readings may need to be taken manually.

Responsibility is set: if a smart meter stops working, the supplier is responsible for maintenance and will fix or replace it³⁴. Where a smart meter installation fails because of a fault within the supplier's control, Ofgem's proposed Guaranteed Standard provides for compensation to the consumer⁴¹.

There is also a network-wide change ahead. An estimated seven million communications hubs, part of electricity smart meters, will need replacing because they will lose functionality when the 2G and 3G mobile networks close⁴². This is the clearest example of how a smart meter's usefulness depends on infrastructure outside the household's control. See the 3G switch-off and smart meter not sending readings.

Switching supplier and owning a smart meter day to day

Smart meters are optional³⁴. They are now installed in 65% of homes⁵; a parliamentary briefing describes them as installed in half of UK properties⁴³, and the two figures come from different documents and measures.

Switching is not blocked by either meter type. Smart meter users can still choose their supplier, and a SMETS1 meter does not affect the ability to switch⁴⁴. What can change is whether the meter stays smart afterwards:

• SMETS2: designed to allow switching while retaining smart functions, including automatic readings⁴¹; the household should be able to switch without interruption to readings or bill payments⁴⁴.
• Cross-compatibility: a smart meter keeps its smart functions across all suppliers, and SMETS2 is now the meter type for new installations⁴².
• SMETS1 and after a switch: the meter may not work in smart mode with the new supplier, so manual readings may be needed; it may work in smart mode again after a later change of tariff or supplier⁴⁵.
• Services may differ: a new supplier might not offer all smart services, such as remote readings, and the meter may need replacing⁴⁶.

Many customers on smart prepayment can also switch while keeping the meter⁴⁷. Private renters whose bills are in their name, or who prepay, can choose a smart meter after checking the tenancy agreement and telling the landlord⁴². More on this is on monitoring in flats and rented homes.

For energy independence, a smart meter offers better information and access to time-based tariffs, but it adds dependence on a supplier's systems, the DCC and the mobile networks behind it. The wider picture is set out on smart meters and energy independence and the smart meters and home energy management guide.