Cyber Awareness

Supermarket Fridge Hacks Spark Broader Cybersecurity Concerns

By Hanna Duggal, Marium Ali

In less than a month, hackers have taken control of supermarket fridges in Europe, causing fires and spoiling millions of euros of food. On October 11 and 12, attackers heated units at about 700 French stores to as high as 50 °C (122 °F). A second wave of suspected cyberattacks on November 2 affected supermarkets and food businesses in at least nine European countries, including Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. France has blamed the first attack on Shahid Kaveh, a cyberunit affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC), calling it the first large‑scale sabotage cyberattack on French soil. The perpetrators behind the second wave remain unknown.

The attacks highlight how exposed internet‑connected equipment has become, from industrial machinery to household appliances. Supermarket fridges and freezers are run from a single control panel that is connected to the internet so contractors can manage it remotely. Home smart fridges use the same connectivity, through Wi‑Fi, an app or a cloud service. Attackers reportedly found the supermarket systems using Shodan, a search engine for internet‑connected devices. According to Vincent Strubel, head of France’s National Cybersecurity Agency (ANSSI), the hackers exploited basic security failures: the equipment was directly connected to the open internet with no extra protection, many systems were protected only by weak or default logins, and many units were old models that no longer receive security updates. Once inside, hackers can switch a fridge off, raise its temperature or steal account details. In France, they used the controllers’ own defrost function. A poorly protected fridge can also serve as a doorway to other devices on the same network, from laptops to smart locks. Strubel warned in the French Senate on October 21 that the healthcare sector uses the same type of equipment to store vaccines and hazardous materials, from research laboratories to pharmacies.

Anything connected to the internet could potentially be hacked. There are about 21 billion short‑range connected devices, such as smartwatches, worldwide and 5.4 billion long‑range ones, such as remote monitoring systems, according to Kepios’s Digital 2027 Global Overview Report. US internet households now have an average of about 18 connected devices, nearly double the number a decade ago, according to Parks Associates. Routers are among the biggest targets because they are always online. In April, the UK’s National Cyber Security Centre (NCSC) warned that hackers linked to Russia’s GRU military intelligence were hijacking home and small business routers. By tampering with their DNS settings, the hackers redirected users to fake websites to steal passwords and personal details.

Smart TVs can be hacked without their owners knowing. In June, researchers found that more than a third of apps on LG and Samsung smart TVs could let strangers secretly use a household’s internet connection, hiding their own activity behind that home’s IP address. Robot vacuums can expose even more. Earlier this year, a programmer reportedly found he could control almost 7,000 DJI Romo robot vacuums with a PlayStation 5 controller. Using Claude Code, an AI coding tool made by Anthropic, to work out how the vacuums talked to DJI’s servers, he gained access to their live camera feeds, audio and floor plans of people’s homes.

The same weaknesses that expose a fridge can affect power plants, water supplies, banks and hospitals. Many of these services are run by industrial computers that can be reached online. Since the US‑Israel war on Iran began, US agencies have warned that Iran‑affiliated hackers are attacking these systems. In July, a cyberattack in the US state of Minnesota targeted more than 30 community water systems, according to the state’s IT agency. Officials suspected Iran‑aligned hackers, and the FBI and CISA warned that water and wastewater systems were increasingly being targeted, with facilities in 12 states affected at the time. That same month, a cyberattack attributed to Iran‑linked hackers forced a small British power plant offline for four days. It was reported as the first successful attack of its kind on UK energy infrastructure.

Banks are targets, too. In late September and early October, hackers stole personal data from at least seven South Korean financial firms, affecting about 68,000 people. Yegaram Savings Bank and Shinhan Bank were hit hardest, with about 40,000 and 25,000 customers affected, respectively. According to The Wall Street Journal, the attacker used ARTEX, an open‑source AI tool developed in China to test networks for weaknesses. US cybersecurity firm CrowdStrike said the attacker was likely a China‑based individual who also used Claude Code, an assessment it made with moderate confidence.

The European Repository of Cyber Incidents (EuRepoC) logged 4,932 major incidents between January 2000 and November 2026. The number of incidents has grown sharply in recent years, peaking at 795 in 2024. About two‑thirds of all incidents recorded since 2000 have occurred since 2022. Governments are the biggest target, with state institutions accounting for nearly 40 percent of all targets, led by the civil service and government ministries, followed by the military, police, political parties and legislatures. Critical infrastructure is the second most targeted sector, led by health, finance, telecommunications, transport and energy, followed by defence firms, manufacturing, research and digital service providers.

Hackers rely on weaknesses such as weak passwords and devices that no longer receive updates. Awais Rashid, a professor of cybersecurity at the University of Bristol, told Al Jazeera that as infrastructure becomes more digitised, the risk of disruption from cyberattacks has risen. The UK’s NCSC also advises people to turn off features they don’t use, such as remote camera access. If a power plant or water system is hacked, there is little individuals can do. The UK’s Be Ready campaign, launched last month partly in response to cyber‑threats, urges households to keep a three‑day supply of water, food, medicine, cash and torches.