A coffee machine consumed 1 terabyte of data in ten days, and nobody in the house noticed until someone thought to check the router logs. The story went viral, hit Hacker News with 334 upvotes and 203 comments, and got covered by outlets that normally write about esports — because the number is so viscerally absurd it breaks people's mental models. But the biggest pitfall isn't the data volume itself: it's that the average small team office has eight to fifteen similarly networked devices right now, none of them monitored, and most of them manufactured by vendors whose data practices are entirely opaque.

This is not really a story about coffee. It's a story about what happens when cheap connected hardware, invisible telemetry, and zero network monitoring collide in environments that were never designed to handle enterprise-grade IoT risk. For small teams, freelancers, and agencies, the implications are immediate and practical.

What Actually Happened Here

The story originated from a social media post in which a person discovered, through their ISP's data usage dashboard, that a single device on their parents' home network had consumed approximately 1 terabyte of data across ten days — roughly 100GB per day. When they traced the device ID back through their router's connected-device list, it mapped to a "smart" coffee machine. The post spread rapidly because the number is shocking enough to be memorable.

Let's put 1TB/10 days in context. A standard 1080p video stream consumes roughly 3GB per hour. A 4K stream is closer to 7–10GB per hour. At 100GB per day, this coffee machine would have been generating the equivalent of 33 hours of HD video upload every single day. That rules out routine telemetry — usage stats, brew counts, temperature logs — which would realistically generate a few megabytes per day at most. It also rules out firmware update polling, which might spike briefly but not sustain.

Three plausible explanations fit the data:

The machine was compromised and enlisted into a botnet. IoT devices are disproportionately targeted because they run stripped-down operating systems with minimal security, rarely receive patches, and sit on home or small office networks with no monitoring. A compromised device can be used to relay traffic for other actors — essentially using the household's bandwidth as a proxy. In this scenario, the 100GB/day has nothing to do with coffee and everything to do with someone else's traffic running through the machine's network stack.

The machine has an embedded camera or microphone and was streaming footage. Some premium connected espresso machines do include cameras, ostensibly for monitoring brew quality or for setup assistance via companion apps. If that stream was being sent continuously to a cloud server — or if the stream was intercepted and redirected — the bandwidth figures become plausible.

There is a catastrophic firmware bug causing the device to loop-upload a crash log, status dump, or telemetry payload indefinitely. This is less likely to sustain over ten days without the manufacturer's backend triggering some kind of circuit breaker, but it has happened with poorly built IoT firmware.

The specific machine involved has not been definitively identified in the public reporting, which is itself notable. The manufacturer, if identifiable, would face substantial pressure. The ambiguity in the coverage suggests either the owner couldn't identify the exact model, or the story spread faster than the details could be confirmed.

What this reveals about the broader IoT ecosystem is more important than the specific device. Consumer and prosumer "smart" appliances — coffee machines, printers, smart TVs, HVAC controllers, security cameras, connected speakers — are increasingly shipped with network connectivity as a default feature, not an opt-in one. The connectivity enables companion apps, remote monitoring, and manufacturer telemetry. But the terms governing what data is collected, where it goes, and how long it's retained are buried in license agreements that no one reads.

The hardware supply chain adds another layer. Many connected appliances sold under Western brand names use components and firmware modules sourced from a small number of ODM (original design manufacturer) suppliers, predominantly based in China. The firmware telemetry modules are often shared across dozens of different branded products. When a data exposure issue exists in a module, it affects every product that module shipped in — regardless of what brand name is on the front.

Why This Is Happening More, Not Less

Twelve months ago, this story would have generated the same reaction. Five years ago, too. What's different now is the scale of the installed base and the growing sophistication of the attacks targeting it.

The number of active IoT devices globally crossed 18 billion in 2025. Most of these are consumer-grade devices with no security certification, no mandatory patch lifecycle, and no regulatory requirement to disclose data collection practices beyond a vague app privacy policy. The attack surface for IoT-targeted botnets has grown in direct proportion.

Simultaneously, ISP-level data monitoring has become more accessible. Five years ago, most people had no easy way to see per-device data usage; they'd only notice when a bill came in over a data cap, or not at all on unlimited plans. Router firmware has improved significantly — platforms like OpenWrt, DD-WRT, and even the stock firmware on consumer Asus and TP-Link routers now offer per-device traffic monitoring through accessible dashboards. This is what allowed this discovery to happen at all.

The timing also coincides with a regulatory shift. GDPR enforcement around IoT data has been accelerating in Europe, with fines levied against device manufacturers for undisclosed telemetry. The California Consumer Privacy Act and its successors have created some baseline obligations in the US. But enforcement is slow, and the gap between what regulations require and what manufacturers actually do remains wide.

For small teams specifically, the threat environment has changed in one concrete way: remote and hybrid work has blurred the boundary between home networks and work networks. A contractor working from a home office with a compromised IoT device may be running their client VPN traffic through the same router that's also connected to a botnet-enlisted coffee machine. A small agency that moved to a co-working space after 2020 now shares a network with dozens of other tenants' devices, none of which are vetted. The "office network" as a controlled perimeter is largely a fiction for most small teams.

Practical Implications for Small Teams

The coffee machine story is an extreme data point, but the underlying pattern — connected devices collecting and transmitting data without meaningful oversight — applies directly to the environments most small teams operate in. Here are four specific scenarios worth thinking through carefully.

The agency with a smart TV in the conference room. Nearly every meeting room TV purchased in the last four years is a "smart TV" with built-in streaming apps, voice control, and telemetry. These devices routinely run Automatic Content Recognition (ACR) software — technology that samples what's displayed on screen, even from external HDMI inputs, and sends that fingerprint to the manufacturer's servers for audience measurement purposes. If your team presents client work, competitive research, or sensitive strategic materials in that conference room, ACR may be sampling that content. Samsung, LG, and Vizio have all faced regulatory scrutiny over ACR practices. The mitigation is simple: disable ACR in the TV's privacy settings or block the TV's internet access entirely. Most agencies have done neither.

The freelancer with a home office on an unlimited ISP plan. Unlimited data plans removed the financial signal that would otherwise flag an anomalous device. If your coffee machine or smart speaker is consuming 50GB/day, your bill doesn't change. You only discover it if you actively look. For a freelancer handling client data under a contract with data security provisions, an unmonitored IoT device on the same network creates a real compliance exposure — even if that device never directly accesses client files. The "reasonable security measures" language in many client contracts and NDAs can be read to include basic network hygiene.

The small SaaS team using a shared physical office. When a five-person startup takes a lease on a small office, they typically inherit whatever network infrastructure the landlord provides or install a basic consumer router. That network frequently ends up hosting the team's work devices, a couple of smart plugs, a networked printer, a connected thermostat, and sometimes a coffee machine or kitchen display. Nobody installs network monitoring. Nobody segments the IoT devices onto a separate VLAN. The printer alone — most networked printers from HP, Epson, and Canon send detailed usage telemetry, sometimes including thumbnail images of printed pages — represents a real data leak vector.

The e-commerce or content team operating under GDPR. If your business handles EU customer data and you're operating under GDPR, your obligation isn't limited to your CRM and databases. A data breach includes unauthorized access to or exfiltration of personal data, and if your network has devices that are actively exfiltrating data to unknown parties, you have a problem that extends beyond a curiosity. A smart device compromised as a botnet node and proxying traffic might also be intercepting unencrypted network traffic. Most teams in this position have no idea this is happening and would fail any serious data protection audit.

The through-line across all four scenarios is the same: these aren't exotic attack vectors requiring sophisticated adversaries. They're default behaviors of consumer hardware sitting in spaces where the people responsible for them have no monitoring and no policy.

How to Audit and Secure Your Network

This is actionable and does not require a dedicated IT hire. A small team can meaningfully improve their network visibility in a single afternoon.

Step 1: Run a full device discovery scan. The first thing to do is know what's on your network. Fing is the fastest tool for this — download the mobile app, connect to your Wi-Fi, and run a scan. It will enumerate every device with an IP address on your network, attempt to identify the manufacturer and device type, and flag anything unfamiliar. What tripped up our editorial review of typical small office setups is how many devices appear that nobody remembered adding — old tablets, a forgotten smart bulb hub, a printer that was "replaced" but never decommissioned.

Step 2: Check your router's per-device traffic logs. Most routers sold in the last three years have some form of traffic monitoring. Log into your router's admin panel (typically 192.168.1.1 or 192.168.0.1) and look for a "Traffic Monitor," "Bandwidth Monitor," or "QoS" section. Asus routers with AiProtection, TP-Link with their Tether app, and Netgear with their Insight platform all offer reasonable traffic visibility. If you see any device consuming more than a few hundred MB per day beyond expected use cases, flag it.

Step 3: Segment IoT devices onto a separate VLAN or guest network. This is the single most effective mitigation available to small teams. All modern consumer mesh systems (Eero, Google Nest, Ubiquiti) and most decent routers support a "guest network" that is isolated from your main network. Move every IoT device — smart TVs, printers, coffee machines, connected speakers, smart plugs — onto this isolated network. Devices on the guest network can access the internet but cannot communicate with your laptops, NAS drives, or other work devices. Even if a guest-network device is compromised, the blast radius is contained.

Step 4: Deploy a monitoring layer. For most small teams, Firewalla is the most practical option. It's a small hardware device (~$199–$269 one-time, no subscription) that sits on your network, monitors all traffic at the DNS and flow level, and will alert you when a device starts behaving anomalously — like a coffee machine suddenly uploading 10GB overnight. The setup is about 15 minutes. Pi-hole is a free alternative if you have a spare Raspberry Pi and some comfort with Linux; it provides DNS-level blocking and logging that will catch most telemetry calls. GlassWire works well for per-computer monitoring on Windows but doesn't cover IoT devices.

Step 5: Apply a blocking policy for unknown or unnecessary outbound traffic. Firewalla, Pi-hole, and pfSense all allow you to create rules that block outbound connections from specific devices to specific destinations. A coffee machine has no legitimate reason to connect to servers outside of its manufacturer's update endpoint. Blocking all outbound traffic from IoT devices except to explicitly whitelisted domains is aggressive but effective.

Step 6: Develop a basic device intake policy. For teams, this means agreeing that before any new connected device gets plugged in, someone notes the device, its MAC address, and its intended use. Takes five minutes. Eliminates the problem of devices appearing on the network that nobody can account for six months later.

Network Monitoring and IoT Security Tools: Practical Comparison

Tool Best For Free Plan Starting Price Key Differentiator
Firewalla Gold Small office, plug-and-play monitoring No ~$269 one-time No subscription, physical device, covers all network traffic
Pi-hole Tech-comfortable teams, DNS-level blocking Yes (self-hosted) Free + ~$35 Pi hardware Extremely granular DNS logging, open source
GlassWire Per-Windows-device monitoring, freelancers Yes (limited) ~$39/year Visual traffic graphs, easy UI for non-IT users
Little Snitch Mac-centric teams, app-level outbound control No ~$45 one-time Per-application outbound control on macOS
Ubiquiti UniFi 5–20 person offices, VLAN segmentation No ~$109/access point Enterprise-grade IoT isolation, scalable
Fing Quick network audits, device discovery Yes ~$30/year (Plus) Fastest device identification, mobile-first
PRTG Network Monitor IT-managed setups, larger teams Yes (100 sensors) ~$1,799/year Deep SNMP/flow monitoring, enterprise reporting
Wireshark Deep packet inspection, incident investigation Yes (open source) Free Raw packet capture, steep learning curve

The practical recommendation for most small teams is to start with Fing (free, five-minute audit) and Firewalla (one-time purchase, covers the office permanently). If you're Mac-heavy, add Little Snitch on developer and admin machines. If budget is zero and you have any Linux experience, Pi-hole is the highest-value free option.

What the HN Community Is Saying

The Hacker News thread generated 203 comments, and reading through it reveals a few distinct camps with genuinely different takes.

The largest contingent immediately moved to "this is a botnet." Multiple practitioners with networking backgrounds pointed out that sustained 100GB/day from a consumer IoT device is consistent with the device having been enlisted as a relay or proxy node, not with any plausible first-party telemetry use case. Several commenters noted they've seen this exact pattern with compromised NAS devices and smart cameras on home networks — the device's CPU and network stack get borrowed by a botnet operator, and the legitimate owner sees only the bandwidth bill.

A second significant group focused on the manufacturer data collection angle, particularly regarding devices with firmware sourced from Chinese ODMs. Comments in this thread — as in virtually every IoT security thread on HN — referenced the 2020 Verkada camera breach, the ongoing concerns about Tuya-based smart home devices, and the difficulty of auditing firmware on consumer hardware. Several practitioners noted that even without compromise, some manufacturers design their firmware to treat the user's bandwidth as a free resource for their own infrastructure — syncing telemetry, distributing firmware updates to other users via peer-to-peer, and running cloud connectivity keepalives at intervals that can add up.

Skeptics questioned the methodology of the data collection. A few commenters pointed out that some ISP dashboards attribute mobile hotspot usage or shared network traffic to incorrect device IDs. Others noted that the original poster may not have had a precise mapping between device ID and physical device. The concern is legitimate — network attribution in consumer environments is unreliable — but the skeptics were largely in the minority, partly because similar stories have been verified independently on multiple occasions.

The practitioner-advice pile was heavy with Firewalla and Pi-hole recommendations, with an extended sub-thread on whether UniFi or pfSense is the right infrastructure choice for a home office. There was also a notable thread arguing that the real fix is regulatory: that connected devices should be required to disclose all network endpoints they contact, similar to how apps are now required to show "nutrition labels" in app stores.

What caught our attention in the thread was the consensus among people who actually work in network security: this is not an unusual finding. The unusualness is that someone checked. The number of people who responded with "I've found similar things on my own network when I finally looked" was striking.

Risks and Things to Watch

Deploying network monitoring and IoT segmentation introduces its own set of considerations that small teams should think through before acting.

Vendor lock-in in monitoring tools. Firewalla stores activity logs locally on the device, which is a privacy advantage, but the companion app and some features require their cloud infrastructure. If Firewalla the company ceases to exist or changes its pricing model, you're holding a hardware paperweight. Pi-hole, being fully self-hosted and open source, has no such risk — but it requires ongoing maintenance. Teams should think about the operational dependency they're accepting.

False confidence from partial monitoring. A Pi-hole blocking DNS telemetry doesn't stop traffic that bypasses DNS — many devices are now hardcoded to use IP addresses directly, specifically to defeat DNS-based blocking. Firewalla and proper router-level monitoring catch more than DNS-level tools alone. The risk is that teams deploy one layer, believe they've solved the problem, and miss the traffic that runs around it.

The GDPR scope question. For EU-focused businesses, network monitoring logs can themselves become personal data if they contain device identifiers tied to individuals. The act of monitoring your network to catch IoT data leaks could, if implemented without a proper legal basis and data retention policy, create a GDPR compliance issue of its own. Smaller teams should consult briefly with their data protection contact before deploying any system that logs employee or visitor device activity.

The hardware replacement cycle. The real solution to IoT devices with problematic firmware is to stop buying them or to replace them with devices from vendors with better security practices. But that creates a cost and disruption cycle. Teams need to be realistic: the smart printer that was purchased three years ago isn't going to be replaced tomorrow just because its telemetry is aggressive. The practical move is containment (VLAN segmentation, outbound blocking) rather than elimination.

Hype risk around the specific story. The 1TB figure is viral-worthy precisely because it's extreme. Most IoT devices in a typical small office will show suspicious but less dramatic behavior — a printer sending a few hundred MB of unclear data per week, a smart TV making frequent calls to advertising measurement servers. These are real issues, but they don't generate the visceral response that a coffee machine burning through a terabyte does. Teams should calibrate their response to the real risk profile, not the peak headline case.

Frequently Asked Questions

Could a coffee machine really generate 1TB of data, or is this exaggerated?

The figure is physically possible, which is why it traveled so widely. At 100GB/day, the device would need to be either streaming continuous video (plausible if it has a camera), operating as a botnet relay (the most likely explanation for sustained high volume), or running a catastrophic firmware loop. Standard telemetry — usage data, temperature readings, error logs — would generate a few megabytes per day at most, so the 1TB figure almost certainly reflects either compromise or a device with hardware capabilities beyond what most people assume a coffee machine has. The original claim hasn't been independently verified at the hardware level, so some skepticism about the exact number is warranted — but orders-of-magnitude errors in ISP data attribution are rare.

How do I find out what my own devices are sending?

The fastest starting point is Fing for device discovery and your router's built-in traffic monitor for per-device bandwidth. For deeper inspection, Firewalla gives you destination IP visibility (you'll see whether your coffee machine is talking to 12 AWS endpoints or one Nespresso server). For the most granular view of what's in the packets themselves, Wireshark on a machine set to monitor mode can capture traffic — but interpreting the output requires networking knowledge. Most small teams will get 80% of the value from Firewalla or a decent router dashboard without needing packet capture.

Is this a China-specific problem, or does it apply to all connected device manufacturers?

It applies broadly, but the risk profile varies. Devices with firmware from Chinese ODM suppliers — which includes a significant portion of the connected appliance market, often hidden behind Western brand names — have historically shown more opaque telemetry behavior and have been the focus of most documented large-scale data collection concerns. US and European manufacturers have also faced scrutiny: Vizio was fined $2.2 million by the FTC for ACR data collection without adequate disclosure, and multiple HP printer models have been documented sending usage data including print content thumbnails. The safest assumption is that any connected device from any manufacturer is sending more data than the marketing materials disclose.

What's the actual threat to my business data from a compromised IoT device?

The primary risks are bandwidth theft (as in the coffee machine case), the device being used to attack other systems on your network if it can reach your main VLAN, and passive traffic interception if the device is sophisticated enough to run a man-in-the-middle capability. The last scenario is the highest-severity but lowest-probability for most consumer IoT. The most common real-world impact is bandwidth consumption and the device being used as a botnet node to attack third parties — which creates legal and liability exposure if the attack traffic is traced back to your IP address.

Does putting devices on a guest network actually prevent them from attacking my main network?

A properly configured guest network — one that enforces client isolation and blocks cross-VLAN traffic — does prevent a guest-network device from directly accessing your main network devices. However, it doesn't prevent an attack that works at the ISP or DNS level, and it doesn't stop the device from consuming bandwidth. The guest network is containment, not elimination. For the threat model of "compromised IoT device accessing my NAS or work laptop," guest network segmentation is highly effective. For "compromised IoT device consuming all my bandwidth," you need monitoring on top of segmentation.

Is this something I need to tell my clients about if I'm an agency?

If you handle client data under a contract, the answer depends on what your contracts say about data security. Many agency MSAs include provisions about maintaining "reasonable security measures" and sometimes require notification of security incidents. A compromised device on your network that was actively exfiltrating data would likely qualify as a security incident under strict reading of those clauses. Our read is that most clients won't ask, and most agencies won't disclose retroactively — but building the monitoring infrastructure now means you can confidently say you have oversight rather than hoping no one checks.

What's the simplest possible setup that provides meaningful protection without any technical expertise?

Enable your router's guest network, move every non-work device (smart TVs, connected appliances, personal phones when in the office) to that guest network, and check the router's traffic dashboard once a week. That's it. The guest network is standard on every router sold in the past three years and takes about ten minutes to configure. It doesn't require any new hardware, any subscriptions, or any technical knowledge. For a slightly higher investment, Firewalla requires about 15 minutes of setup and then runs passively, alerting you to anomalies automatically.

Should I just stop buying smart devices entirely?

That's the maximalist answer and it's genuinely defensible. The baseline functionality of a coffee machine — making coffee — doesn't require an internet connection. The connectivity serves the manufacturer (telemetry, lock-in through app ecosystems, ongoing data revenue) far more than it serves you. For purely practical use cases in a small office, "dumb" versions of appliances — if you can find them, which is increasingly difficult — carry zero IoT risk. Where smart devices provide genuine, irreplaceable value (some security cameras, network printers with legitimate business function), containment through segmentation and monitoring is the appropriate response. The broader point is that "smart" should be treated as a risk flag, not a feature, until proven otherwise.

Our Verdict

The coffee machine story is memorable precisely because the number is absurd. But the underlying situation — networked devices with opaque data practices sitting on unmonitored small-office networks — is completely ordinary, and the actual risk for most small teams is real even if the bandwidth numbers are usually far smaller.

For freelancers and solo operators working from home: run a Fing scan today. Look at your router's traffic monitor. If you see anything unexpected, put your non-work devices on a guest network. The setup is free, it takes under an hour, and if you have any client NDAs or contracts that include data security language, it gives you a defensible answer if anyone ever asks what network controls you have in place.

For small agencies and SaaS teams: guest network segmentation for all IoT and shared-space devices is the baseline, and it should have been done already. If you have a physical office, a Firewalla or comparable monitoring device is a worthwhile one-time investment. Prioritize the conference room TV (ACR), the networked printer (usage telemetry and possibly content sampling), and any connected kitchen appliances. These three device categories account for the majority of unexpected small-office data exfiltration in documented cases.

For teams operating under GDPR or with client contracts that include security terms: the guest network segmentation and basic monitoring is no longer optional hygiene — it's a reasonable baseline expectation. Document what you've done. The moment you have a written record of your network controls, you've substantially reduced your exposure in any future audit or client conversation.

Who should wait? Nobody, really. The steps described here range from free to a one-time ~$200 hardware cost. The time investment is an afternoon. The upside is genuine visibility into what's happening on a network that you've probably been running blind. The downside risk of not acting is a compromised device using your IP address to attack third parties, exceeding your data cap, or — in the worst case — capturing traffic from a network where you're handling client data.

The coffee machine story will be forgotten in a week. The devices it represents won't be. They're plugged in, they're connected, and in the overwhelming majority of small offices, nobody is watching.