Can a Smart Meter Be Hacked? Security of the Smart Metering System

Smart meters have been rolled out to millions of British homes, and the question people keep asking is a simple one: can they be hacked? The honest answer is that no connected system can be declared impossible to attack, but the GB smart metering system was built from the outset to make an attack extremely difficult, with input from the National Cyber Security Centre (NCSC), the arm of GCHQ that advises on cyber security¹. The network your meter talks over is not the public internet; it is a dedicated, closed system that operates entirely separately from it, and the data crossing it is wrapped in two layers of encryption¹.

That design matters for a household's energy independence in a specific way. A smart meter does not make you independent of the grid or your supplier; it deepens the data link between your home and the company that bills you. What the security architecture determines is how much control you keep over that link: who can see your usage, who can change settings on the meter, and how hard it would be for anyone else to interfere. The system also carries no personal information on the meter itself; your name, address and bank details are not stored on it².

Smart meters are optional, and you can request one from your supplier if you have not already been offered one³. Before deciding, it is worth understanding exactly what the security regime does and does not cover, because the strongest protections apply to the metering system itself, and the weaker points sit in the devices people add around it.

Made to resist hacking, not to make it impossible

The starting point for any honest answer on smart meter security is that the system's designers never claimed it was unhackable. What they claim, and what the architecture supports, is that the system was "designed with security at its core, alongside the National Cyber Security Centre (NCSC)", the part of GCHQ that handles cyber security². Smart Energy GB puts the same point in consumer terms: smart meters "have been designed with top cyber security experts, including the government and GCHQ, to ensure that security is built in"¹.

Three features do most of the work. First, the meter does not sit on your home Wi-Fi or broadband; it communicates over a dedicated wireless network that operates separately from the public internet, so the usual routes an attacker would use against a home device, such as your router, are not available¹. Second, the data in transit is encrypted twice over, so intercepting a reading yields nothing readable². Third, the meter itself holds nothing worth stealing: personal information such as your name, address and bank details are not stored on it².

For a householder, the practical meaning is this. The realistic threats to a home with a smart meter are not someone cracking the meter over the air; they are the ordinary risks of any connected household, the security of the third-party devices you choose to connect, and the operational frustrations of a system that occasionally loses contact. Those are covered in the sections below, and they are where attention belongs.

How protection works: encryption, GCHQ procedures and closed networks

The security of the GB system rests on a closed, purpose-built communications path rather than any consumer internet connection. Sending a meter reading does not require an internet connection, because smart meters work using the DCC's secure, standalone network⁷. The network "uses two layers of encryption and operates entirely separately from the potential pitfalls of the public internet"⁶. Data is securely wrapped using those two layers, and a communications hub in the home creates a home area network to carry readings from the meter⁵.

The physical path out of the home is a wide area network made up of mobile phone or radio masts, and the DCC network "operates to security levels endorsed by the National Cyber Security Centre, part of GCHQ"⁵. The DCC also runs a firmware service that allows remote upgrades of meters, unlocking new functionality as innovation is created⁵. That remote upgrade capability is itself a security feature worth noting: it means known weaknesses in meter software can be patched across the estate without a visit to every home, which is something an old dumb meter could never benefit from.

The Welsh Government's guidance for consumers describes the same arrangement in plain terms: the meter automatically sends your energy usage data to your supplier using a secure network³. The consumer rights guidance on GOV.UK adds the other half of the picture, that you have control over who can access the energy use data from your smart meter, including how often and for what purpose, except where it is required for regulated purposes such as billing⁴. Security and privacy are two sides of the same design here: the encryption protects the data in transit, and the consent rules govern what happens to it at the other end.

The national network your meter communicates over, run by the DCC

Every smart meter in Great Britain that operates in smart mode talks to a single organisation: the Data Communications Company, or DCC. The DCC operates the secure national network that connects smart meters across Great Britain, and through it, smart meter data can be shared securely between authorised users, supporting smart energy services across the sector⁸. There are millions of smart meters connected to the network, bringing consumers and energy suppliers closer together⁵.

The DCC's own description of its role is worth quoting, because it frames the relationship between the network operator and your data:

In practice, all readings are sent automatically via the DCC's secure network to your energy supplier, which is how suppliers get accurate and reliable readings and bill you only for the energy you have used¹⁰. The network's infrastructure is commercial as well as technical: DCC's 4G communication hubs are supported by Vodafone's network, an arrangement DCC says can provide services for many years to come¹¹.

For a household thinking about independence, the DCC is the single point of dependence in the system. Your meter does not talk directly to your supplier; it talks to the DCC, which talks to the supplier. That centralisation is precisely what makes the security regime enforceable, since one network, held to NCSC-endorsed standards, carries everything, rather than dozens of suppliers each running their own. The DCC has also said it is working with the regulator on how the issue of consent can be enhanced and improved for consumers⁹, which is an acknowledgement that the consent machinery, not the encryption, is the part of the system still being refined.

Your meter data: what is shared, who can view it and the law

The data that leaves your meter is your energy usage record, and the rules around it are specific. Ofgem sets out what it is used for: to bill you for the energy you use, to offer you new products and services such as new tariffs if you have given permission for that, and to help make the energy system more efficient by recording demand more accurately¹². Nothing else personal travels with it; your name, address and bank details are not stored on the meter².

Who else can see it is tightly defined. Smart meter data is classified as personal data, owned by the consumer, and the consumer is the source of consent for any onward sharing¹³. Distribution Network Operators, the companies that run the local electricity wires, can access smart meter data recorded at 30 minute intervals, but only in aggregated and anonymised form and only for regulated purposes, and they must agree a privacy plan with Ofgem before doing so¹⁴. Third parties signed up to the Smart Energy Code can access data of any granularity, but only via opt-in consent, with regular reminders of that consent and confirmation that the request for the service comes from you¹³.

The protections differ by purpose, and the distinction matters:

• Billing and regulated purposes: your supplier can use the data without a separate opt-in, because accurate billing requires it⁴.
• Marketing and new products: permission is required before your data is used to offer you new tariffs or services¹².
• Third-party services: opt-in consent only, with regular reminders and verification that the request comes from you¹³.
• Network operators: aggregated, anonymised 30 minute data for regulated purposes only, under an Ofgem-agreed privacy plan¹⁴.

For a household, the practical position is that the meter's data trail is governed by consent rules you control, not by the encryption alone. If you want to dig into the detail, our page on smart meter data and the consumer consent solution cover how consent works in practice.

The SMETS specifications and security rules meters follow

Smart meters in Britain come in generations, and the security and service standards attach to the SMETS family, the specification set out in the Smart Energy Code. Ofgem's 2026 decision on the smart meter Guaranteed Standards clarified the scope: the standards should only incorporate SMETS compliant meters, which are set out in the SEC, excluding advanced meters¹⁶. Respondents to that consultation had flagged that the legal drafting referenced the Electricity and Gas Acts in a way that could inadvertently pull advanced metering into scope, and the definition was updated to close that gap¹⁶.

The generation of meter also determines how it behaves on the network. First-generation SMETS1 meters do not always allow the consumer to change energy supplier without losing the ability to send meter readings automatically, and some SMETS1 meters could lose smart functionality on switching¹⁷. Second-generation SMETS2 meters were designed to connect directly to the DCC's secure national network, allowing supplier switching while retaining smart functionality¹⁷. The Guaranteed Standards that protect consumers around installations apply to SMETS meters and microbusinesses, excluding larger non-domestic customers and advanced meters¹⁶.

A proposed standard on installation failures would extend some protections further: it would be applicable to both SMETS and AMR meter installations for all designated premises in the non-domestic sector, and where a smart meter installation fails due to a fault within the energy supplier's control, the consumer would receive compensation¹⁹. The meters themselves are also covered by strict UK and EU product safety laws¹, so the security regime sits inside a wider product legal framework rather than standing alone. If you are unsure which generation you have, our page on SMETS1 and SMETS2 meters explains how to tell.

The genuine weak points: gadgets fitted near the meter

The metering system is closed, but homes are not. The devices people connect around a smart meter, consumer access devices, in-home displays, smart heating controls and hubs, are where the realistic security questions live. Ofgem's response to the Home Area Network installation consultation recorded two concerns from the early rollout: that the technology used by suppliers to connect smart meter installations and In-Home Displays could compromise the provision of a SMETS compliant home area network, and that the consumer could have difficulty connecting consumer access devices to the smart metering system²⁰. Those are integration risks rather than hacking risks, but they shape the day-to-day experience.

The Welsh Government's guidance makes the boundary clear: smart meters are independent of smart heating controls, though combining the two can enhance your ability to manage your home's heating and energy use remotely³. That independence is a security feature. Your heating control app talking to your boiler over Wi-Fi is a separate attack surface from the meter, and a compromise of one does not automatically reach the other.

What the evidence shows instead is reliability friction, not breaches. Ofgem's consumer satisfaction surveys found that a third (35%) of households with a smart meter reported experiencing an issue with it in the last three months, a figure consistent with the previous wave²¹. The same survey series found 37% of households with a smart meter reporting an issue in the prior three months in 2023²³, so the rate has been stable at around a third to just over a third across successive waves. These are overwhelmingly operational issues, displays, connectivity and the like, rather than security incidents. Separately, the Smart Meter Installation Code of Practice change request 034 refined the definition of vulnerability used by members, so that all vulnerable customers are protected during installations²⁴, a reminder that the human side of the rollout has its own safeguards. For the devices themselves, the UK's PSTI regime sets the security baseline, and our page on consumer access devices covers how to get your own data out safely.

Remote cut offs, safety features and other system functions

The security of the metering system exists to protect more than billing. Smart meters support functions beyond reading your energy use, including access to more flexible tariffs, such as dual-rate tariffs¹², and the prepayment functions that let credit be topped up and checked remotely. The same protections that keep billing data safe also keep those functions safe, which is why the NCSC's involvement in the design matters to every household, not just those worried about data privacy.

On safety, the independent evidence is clear. Public Health England sees no risk or dangers to health from smart meters, and exposure to radio waves from smart meters is many times lower than the exposure from Wi-Fi and mobile phones, well within guideline levels¹. The meters are covered by strict UK and EU product safety laws¹. Our page on smart meter health risk goes into the evidence in detail.

Consumer protection around meters has also been reconsidered as the technology has matured. Ofgem concluded in its consultation on meter inspection obligations that other regulations and policies, including safety obligations and recently enhanced theft detection and billing accuracy obligations, protect consumers with traditional and smart meters more effectively than the existing inspection obligation²⁵. In other words, the smart system's monitoring and billing accuracy functions now do work that physical meter inspections used to do. The government has also set strict future annual installation targets for energy suppliers that could result in fines if missed²⁶, which drives the rollout but also keeps suppliers accountable for the quality of what they install. If a meter stops working, the supplier is responsible for maintenance and will fix or replace it as needed³.

If the signal cannot reach your meter

A smart meter that cannot reach the DCC network does not stop recording your energy use, but it does stop being smart. Ofgem identifies the causes: a meter loses connection with your supplier, loses connection after you change supplier, or has been installed without being connected to the national communication system²⁷. In that state the meter operates in what is commonly called dumb mode, and you may need to take manual readings again until the connection is restored.

The proposed guaranteed standards address the installation side of this. Where a smart meter installation fails due to a fault within the energy supplier's control, the consumer will receive compensation¹⁹. Some incident management instances on the DCC's service are covered by a 90-day Service Level Agreement¹⁸, which sets the timescale within which certain network faults are expected to be resolved.

For a household, the practical steps are straightforward. Contact your supplier, who is responsible for maintenance and will fix or replace the meter as needed³. Our pages on smart meters not sending readings and meters in dumb mode cover the troubleshooting detail, and the guaranteed standards page explains what suppliers must do and when compensation is due.

Changing supplier and living with a smart meter

Day to day, a smart meter changes less than people fear and more than people expect. The readings are sent automatically over the DCC's secure network, so no one needs to read the meter or submit figures, and billing reflects the energy actually used¹⁰. The meter comes with an in-home display so you can see and manage your energy use⁴, and private renters can choose a smart meter if the energy bills are in their name or they prepay for energy, after checking the tenancy agreement and letting the landlord know²⁸.

Supplier switching is where the generations diverge. SMETS2 meters allow consumers to switch supplier while retaining smart functionality, including automatic meter readings²⁹, and cross-compatibility means a smart meter will keep its smart functions across all energy suppliers²⁸. SMETS1 meters are the exception: they do not always allow switching without losing automatic readings⁷, and Ofgem rules require a supplier installing a smart meter to inform the customer that they may lose meter functionality on change of supplier³⁰. Trading standards guidance for consumers puts the same caveat plainly: you can switch suppliers if you have a smart meter, but the new supplier might not offer all smart meter services such as remote meter readings, and the meter may need replacing³¹. If your supplier goes out of business, your meter may not work in smart mode when you move to the new supplier, and you may need to take manual readings, though it may work in smart mode again if you change tariffs or suppliers³².

The scale behind all of this is tracked in official statistics: quarterly figures on the roll-out of smart meters in Great Britain cover both operating and installed meters³³. The system's promise to the household is accurate billing, flexible tariffs and no more estimated reads; its remaining dependence is on the DCC network, your supplier's systems and the consent rules that govern onward sharing. The security architecture keeps those dependencies honest, and the parts you add around the meter are where your own choices about connected device security take over.