Why Your Coffee Maker Wants Your Contacts

A US man went viral after noticing his parents' Keurig coffee machine had transmitted a terabyte of data in just 10 days. Around the same time, TechRadar's own testing found a Lavazza coffee machine asking for access to contacts and call logs. Two very different machines, one shared question: what exactly is a coffee maker doing with that kind of reach?

The Keurig that wouldn't stop talking

According to TechRadar, the massive transfer from the Keurig appears to have been caused by a bug rather than deliberate surveillance. The man who spotted it, an IT expert who posts as Nomad, disconnected the device rather than leave it online. In a post on X, he explained his reasoning plainly.

It's not worth keeping an IOT [Internet of Things] device connected that has the capability of bugging out and causing saturation like this did.

— Nomad, IT expert

The detail that made the story spread wasn't the cause, though. It was the scale. 10 days, one terabyte, and a machine whose only job is to heat water and push it through grounds. Even if the trigger was a software fault, the episode showed how much room a connected appliance has to move data once it's on a network.

Nomad later expressed regret about the attention. He said he had always hoped to be remembered for the strange printers he designed and his work at Prusa, describing a legacy of creativity and chaos. Instead, as he put it, he is now most known for a rogue coffee machine — and he doesn't even like coffee.

The Lavazza asking for your call logs

TechRadar's own experience with a Lavazza machine raised a separate set of questions. The app requested permissions for contacts and call logs, which have no obvious relationship to brewing coffee. The outlet said it has asked the company why its app wants those specific permissions, and why the smart features don't seem to work even after the machine is connected.

Those smart features turned out to be limited in practice. Starting a brew through the machine's own app proved impossible. When the team tried to brew an espresso through Google Home as the manual instructed, they were told the coffee maker "doesn't support selecting specific drink types like espresso through smart home commands." So the machine asked for a wide set of permissions while delivering a narrow set of capabilities.

TechRadar said it has contacted both companies for comment and will provide updates when more details are available.

A pattern across the whole kitchen

The coffee maker is not an outlier. Consumer Reports has been cautioning users about smart appliances for some time, and earlier this year it described how the market has shifted. In its warning, it noted that home appliances relying on mobile apps for key functions — and collecting data whether owners like it or not — are becoming the standard, making internet features and companion apps harder to avoid across every product category.

The people testing these devices keep finding the same thing. Consumer Reports' Steve Blair said he found a dryer sending the equivalent of 135,000 text messages per week to its manufacturer. His question was direct: what does a dryer have to say at that volume?

TechRadar's writer described the same experience at home. A heating boiler and a dishwasher both had apps, and both were eager to gather information that had nothing to do with heating a home or washing dishes. That was only the data the apps openly requested.

Connected convenience cuts both ways

There are real benefits to connected appliances, and the source article doesn't pretend otherwise. An Instant Pot app could download slow-cooking instructions for specific dishes. Remote pre-heating for a hybrid car on a cold morning is genuinely useful. Those are the features companies lead with, and they're the reason people keep buying in.

The downside that matters most, according to the article, isn't sinister surveillance. It's the accidental opening of doors for bad actors. Appliance firms aren't known for software expertise or website security, which creates the risk of data ending up somewhere it shouldn't, or of exploits that target the device or other devices on the same network. The practical conclusion follows directly: the less access a device has, the better.

What the data actually shows

The numbers in this story are few, but they're specific, and they're worth reading together rather than separately.

• 1 terabyte of data transmitted by a Keurig coffee machine in 10 days
• 135,000 text messages per week — the equivalent volume a dryer was sending to its manufacturer, per Consumer Reports' Steve Blair

Two devices, two very different functions, and neither figure has anything to do with the job the appliance was bought to do. That gap between what a device needs and what it sends is the thread running through both cases.

The advice that keeps coming up

Consumer Reports recommends thinking about data security before buying any connected product, and asking whether a fridge really needs Wi-Fi in the first place. The organization also suggests setting up a separate network on your router purely for smart devices. The logic is straightforward: if one of those devices is compromised, the attacker isn't sitting on the same network as your laptop or phone.

TechRadar's own framing adds a filter for the shopping stage. Before buying, it suggests asking whether a product actually needs to be smart at all. That's a harder question to answer once the device is already on the counter and the return window has closed, which is exactly why it belongs at the point of purchase.

AI makes the question harder

The article notes that with ChatGPT, Gemini and other AI rolling out across all kinds of tech, there's potential for real privacy problems. It doesn't spell out a specific incident or a specific product, and it doesn't claim one. The point is directional: as more capability lands inside everyday appliances, the permission requests and data flows attached to them have more places to go.

That's an observation about trajectory, not a reported event. The concrete cases remain the Keurig and the Lavazza, and both are still waiting on answers from the companies involved.

Why this matters beyond the kitchen

The lesson here isn't really about coffee. It's about the permission request you approve without reading, on a device you bought for one narrow purpose, sitting on the same network as everything else you own. If a coffee maker can ask for contacts and call logs, and if a dryer can generate the traffic equivalent of 135,000 texts a week, then the access a device requests is worth treating as a real decision rather than a formality.

For consumers, the practical takeaway is the one Consumer Reports and TechRadar both land on: ask what a device actually needs before you buy it, and consider giving smart devices their own network so a compromise stays contained. For manufacturers, the viral Keurig case and the Lavazza permission request suggest that appliance software quality and minimal data collection are becoming part of the product, not an afterthought. The companies behind both machines have been contacted for comment, and their answers — when they come — will say a lot about whether this stays a curiosity or becomes a habit.