A man checked why his parents’ home internet had turned to treacle, opened the network monitor, and found the culprit sitting on the kitchen counter. Their coffee maker had uploaded 1,008 gigabytes in ten days.
That is the version that went around the internet this week, and it is accurate as far as it goes. The part that did not travel nearly as far is the follow-up, where the same man explained that almost none of that terabyte actually left his parents’ house. Which makes this a less alarming story than it first appeared, and a considerably more interesting one.
The short version
- The device: a Keurig K-Supreme SMART single serve coffee maker with BrewID
- The numbers: 1,008.45 GB uploaded, 9.94 GB downloaded, over roughly 10 days and 9 hours
- How it was spotted: per device traffic logs in Ubiquiti’s UniFi dashboard, after the parents complained the network was slow
- The twist: the owner later said the traffic mostly stayed inside the local network and never reached the public internet
- The real damage: it saturated a 2.4 GHz access point, which took other devices down with it
- The fix: a reboot, then a separate network. The problem did not come back
What the owner actually found
The poster, who goes by Nomad online, says he has worked in IT for more than a decade and now works at the 3D printer company Prusa. He helps run his parents’ network, which is built on Ubiquiti gear, and Ubiquiti’s software keeps a per device tally of how much data each thing on the network has moved.
When his parents complained that the Wi-Fi had become unusable, he went looking. The screenshot he posted shows the coffee maker with 9.94 GB down and 1,008.45 GB up.
His first reaction was the one most people would have had. Writing on X, he asked Keurig what a coffee machine was doing uploading an entire terabyte of data in ten days, and said he was unplugging it immediately and buying his parents a new one.
That upload to download ratio is the detail that made people sit up. A coffee maker should mostly be listening. Pulling down a firmware update or a set of brew profiles makes sense. Sending out a hundred times more than it receives does not.
Then came the correction
In a follow up post, Nomad walked the alarming part back. He said that while the device did generate roughly a terabyte of traffic, most of it did not escape his network. His working theory is a bug in that particular unit rather than anything deliberate.
He also decided not to dig further. Keeping an IoT device connected that can bug out and saturate an access point like that was not, in his words, worth it. The machine stays offline.
Worth holding at arm’s length. Every number here comes from one screenshot posted by one person about one machine in one house. Nobody has independently captured the traffic, nobody has confirmed what was in those packets, and no second unit has been reported doing the same thing. The volume is plausible and the account is credible. It is still a sample size of one.
Why a terabyte is such an absurd number here
To understand how far out of line this is, it helps to see it next to the things that normally generate traffic in a house. Smart appliances are not supposed to register at all. The heavy hitters in any home are video: streaming boxes and security cameras.
Put plainly: this one appliance, doing nothing anyone asked it to do, moved more data in ten days than a heavy streaming household does in two months.
What the machine is supposed to be sending
The K-Supreme SMART is online for a reason, even if that reason underwhelms. Its headline feature is BrewID, which reads the specific K-Cup pod you drop in and adjusts temperature, brew time and volume to match. It also feeds an app that keeps your favourites and makes recommendations.
We have a decent picture of what that involves, thanks to pykeurig, an open source project that connects Keurig machines to Home Assistant. The data going to the cloud is about as mundane as it sounds.
| What it sends | Realistic size |
|---|---|
| Power status | On or off. A handful of bytes |
| Brewing status | Idle, heating, pouring. A handful of bytes |
| Pod recognition result | An identifier for the pod it just read |
| Software version | A version string, sent rarely |
There is no camera, no microphone and no video. Nothing in that list could add up to a terabyte if the machine ran for a century. Whatever filled those packets, it was not coffee telemetry.
So what went wrong
Nobody has confirmed a cause, and it is worth being honest that the leading explanation is inference rather than finding.
The most credible theory is a fault in the device’s network stack: the layer of software that handles talking over Wi-Fi. When that code gets stuck in a loop, it can hammer out packets endlessly without any of it meaning anything. The evidence pointing that way is circumstantial but reasonable. The behaviour stopped after a reboot and did not return, which is how a transient software fault behaves and not how a deliberate data pipeline behaves. One analysis noted that Keurig’s published open source notices reference Microsoft’s Azure RTOS, an off the shelf operating system and network stack widely used in connected devices, which would be a plausible home for that kind of bug.
People associated with the pykeurig project reached a similar conclusion from the other direction. Given the kinds of data the machine is built to transmit, a terabyte points to a malfunction rather than anything else.
Keurig has not published a statement. UNILAD Tech, which covered the story, said it had approached the company for comment.
The part that actually hurt
Strip out the data exfiltration angle and there is still a genuine problem here, and it is the one that made the parents pick up the phone in the first place.
The K-Supreme SMART only connects to 2.4 GHz Wi-Fi using WPA2 security. It cannot use 5 GHz at all. That is standard for cheap connected appliances, which use basic radio chips to keep costs down, and it is usually harmless.
It stops being harmless when one of those devices goes haywire. 2.4 GHz is a crowded, slow band shared by a long tail of other gear in a typical home: older phones, smart plugs, bulbs, doorbells, printers. A single device transmitting flat out can swamp the access point serving that band, and everything else on it slows to a crawl or drops entirely. That is what the owner meant when he said it saturated his AP. The coffee maker did not steal anything. It just shouted over everyone else until nobody could be heard.
This is the same structural weakness that keeps producing smart home stories with uncomfortable endings. The appliances get connected, then they get forgotten, and the software inside them is rarely examined again. We have seen how little scrutiny these devices get when a robot vacuum’s onboard camera ended up as evidence in a court case, and the trend is moving towards more access rather than less, with Google opening the smart home up to third party AI agents that can act on devices directly.
What to actually do about it
The useful takeaway is not that you should fear your coffee machine. It is that the network design most homes default to has no containment in it whatsoever.
Four things worth doing this weekend
- Put appliances on their own network. Most routers sold in the last few years offer a guest network or an IoT network. Anything that is not a phone, laptop or TV belongs there. A misbehaving device then only ruins its own neighbourhood
- Look at per device traffic once. Many modern routers show how much each device has used. You are looking for anything whose number makes no sense for what it does. That is the entire check
- Ask whether it needs to be online at all. The K-Supreme SMART brews coffee perfectly well disconnected. You lose pod recognition and the app. For a lot of appliances the connected feature is genuinely optional
- Reboot before you panic. In this case a power cycle cleared it. A stuck network stack is far more common than anything sinister
None of this requires expertise. The reason this story surfaced at all is that the household happened to have monitoring gear and someone who knew how to read it. In the overwhelming majority of homes, a device behaving this way would simply register as “the internet is slow again” and nobody would ever find out why.
The wider point
There is a reflex, whenever a connected device does something unexpected, to assume surveillance. Sometimes that reflex is right. Here it probably was not, and the correction deserves to travel as far as the original claim did.
But the thing people were actually worried about is not unreasonable. We have accepted a large number of cheap internet connected objects into our homes, each running firmware almost nobody audits, on chips chosen for price, updated sporadically if at all. Security researchers keep finding that the weakest links in consumer hardware are exactly the components nobody thinks about, from the radio stack upward, and that some of those flaws never get a patch at all.
A coffee maker that floods your Wi-Fi is the harmless version of that problem. It is loud, it is obvious, and someone noticed within ten days. The versions that stay quiet are the ones worth thinking about.
The bottom line
A Keurig K-Supreme SMART really did generate about a terabyte of network traffic in ten days, and it really did knock out a home Wi-Fi band in the process. It almost certainly was not sending that data to anyone, the cause looks like a software fault in the device, and a reboot fixed it.
The lesson is not about Keurig. It is that one cheap appliance, with no camera and no microphone and nothing interesting to say, was able to take down the network for an entire household. Give the things in your kitchen their own corner of the network, and the next one that misbehaves takes nothing down with it.
Sources and further reading
- UNILAD Tech: Man uncovers coffee machine used 1TB of data in just 10 days
- Tom’s Hardware on the follow up, and why most of the traffic never left the network
- TechSpot: A smart coffee maker uploaded 1TB of data in 10 days, and nobody knows why
- Cybernews on the security reading of the incident
- BigGo: the network stack bug theory, and what pykeurig shows the machine normally sends
- Gadget Review with the exact figures from the UniFi screenshot
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
