A Keurig smart coffee maker sent 1TB of data over a home Wi-Fi network in ten days, saturating an access point on its own. The owner, Nomad, a technical specialist with more than ten years of IT experience now working at 3D printer maker Prusa, posted UniFi screenshots on X on October 5, tagging Keurig directly.
The problem came to light when his parents asked why their network was so slow. The screenshot shows the device, listed as Keurig on the appliance network, sending about 1,008 GB upstream and receiving 9.94 GB downstream over 10 days and 9 hours. That works out to roughly 97 GB a day, with an average upstream of around 9 Mbps, enough to overwhelm an access point.
The model is the K-Supreme SMART with BrewID, which connects over 2.4 GHz Wi-Fi and can be controlled through an app and voice assistants. BrewID recognizes Keurig pods and applies the recommended settings, a detail that led Nomad to speculate that DRM could later restrict the machine to official pods.
Later in the thread, Nomad acknowledged that the UniFi console had not logged an actual 1TB upload to the outside. Most of the traffic appears to have stayed on the local network, probably because of a bug. The device was already on a separate IoT network with the family's other smart gadgets, but almost nothing was filtered. Rebooting it and moving it to a segregated VLAN fixed the problem, at least for now. Nomad chose not to run packet captures and unplugged the machine, asking Keurig to fix the flaw in the firmware's network stack.
The firmware itself is opaque. According to the open-source pykeurig project used for Home Assistant integration, the data sent to the cloud covers power state, brew state, pod recognition and software version: tiny payloads that cannot account for a terabyte. Keurig's open-source notice lists Microsoft's Azure RTOS, an off-the-shelf operating system and networking stack for IoT, but the proprietary firmware is not public. The radio module is registered to Jabil, a manufacturer Keurig has previously linked to its subsidiary Nypro, though that does not reveal who wrote the code.
Keurig has not commented. Its machines work without Wi-Fi, but many marketed features depend on internet access, which makes a possible flaw a real concern for owners. Nomad has suggested other units could behave the same way. A patch or an official statement will show whether this is an isolated case.
The wider IoT surveillance concern
The episode arrives as users and privacy advocates are already worried about data collection by connected devices. Keurig had shared brewing data with the brands that sell its K-Cups, according to a 2022 Boston Globe report.
No comments yet. Be the first!