50°C (122°F). That is the temperature attackers dialed into refrigeration units at about 700 French stores on 11–12 October, spoiling food on a national scale. On 2 November, a second wave of suspected cyberattacks hit supermarkets and food businesses in at least nine European countries, including Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. France blamed the first wave on Shahid Kaveh, a cyberunit affiliated with Iran’s Islamic Revolutionary Guard Corps, calling it the first large-scale sabotage cyberattack on French soil. Whoever ran the second wave is unknown.
How you hack a fridge
The mechanism is not exotic, as Al Jazeera’s Hanna Duggal and Marium Ali explain. A supermarket’s fridges and freezers run from one control panel, connected to the internet so contractors can manage it remotely. Home smart fridges connect the same way. The attackers reportedly found the supermarket systems through Shodan, a search engine that indexes internet-connected devices. Vincent Strubel, head of France’s National Cybersecurity Agency (ANSSI), listed the failures that let them in: equipment exposed directly to the open internet, weak or default passwords, and old units that no longer receive security updates. Once inside, the attackers needed no malware sophistication at all — they ran the controllers’ own defrost function. A compromised device on a flat network is also a pivot point to laptops and smart locks on the same segment.
Speaking to the French Senate on 21 October, Strubel pointed out that the healthcare sector stores vaccines and hazardous materials in the same class of remotely managed equipment, from research laboratories to pharmacies. The fridge attacks were a demonstration; the inventory of what runs on identical plumbing is the threat.
26 billion devices, several already demonstrated hackable
The exposure counts are measurable. There are about 21 billion short-range connected devices worldwide, such as smartwatches, and 5.4 billion long-range ones, such as remote monitoring systems, according to Kepios’s Digital 2027 Global Overview Report. US internet households average about 18 connected devices, nearly double the figure of a decade ago, according to Parks Associates. Each is a login page, most with a default password some owners never change.
Three recent cases give the attack surface specific numbers. In April, the UK’s National Cyber Security Centre warned that hackers linked to Russia’s GRU military intelligence were hijacking home and small-business routers and tampering with DNS settings — the lookup that turns website names into IP addresses — to redirect users to fake sites that harvest passwords. In June, researchers found that more than a third of apps on LG and Samsung smart TVs could let strangers route traffic through a household’s connection, hiding behind its IP address. And earlier this year a programmer reportedly found he could drive almost 7,000 DJI Romo robot vacuums with a PlayStation 5 controller, after using Anthropic’s Claude Code to work out how the vacuums talked to DJI’s servers; access included live camera feeds, audio and floor plans of strangers’ homes. That last case is a single researcher’s claim, but it required no nation-state budget.
Water, power, banks
The same weaknesses reach services individuals cannot patch. In July, a cyberattack in Minnesota targeted more than 30 community water systems, according to the state’s IT agency; officials suspected Iran-aligned hackers, and the FBI and CISA warned that water and wastewater facilities in 12 states were being targeted at the time. Since the US-Israel war on Iran began, US agencies have warned that Iran-affiliated hackers are attacking such systems. Also in July, a cyberattack attributed to Iran-linked hackers forced a small British power plant offline for four days — reported as the first successful attack of its kind on UK energy infrastructure.
In late September and early October, hackers stole personal data from at least seven South Korean financial firms, affecting about 68,000 people; Yegaram Savings Bank and Shinhan Bank were hit hardest, with about 40,000 and 25,000 customers respectively. According to The Wall Street Journal, the attacker used ARTEX, an open-source AI network-testing tool developed in China. CrowdStrike assessed, with moderate confidence, that the attacker was likely a China-based individual who also used Claude Code. Moderate confidence, one firm’s attribution: hold it accordingly. The tool that surfaced in both the vacuum case and the bank case, though, is the same commodity AI coding assistant — the cost of probing a device’s protocol is falling toward zero.
What the incident database shows
The European Repository of Cyber Incidents (EuRepoC), which tracks politically significant cyberattacks worldwide, logged 4,932 major incidents between January 2000 and November 2026. The count peaked at 795 in 2024, and about two-thirds of everything recorded since 2000 has occurred since 2022. State institutions account for nearly 40 percent of targets — civil service and ministries first, then military, police, parties and legislatures — with critical infrastructure second, led by health, finance, telecommunications, transport and energy. EuRepoC covers only political attacks, a fraction of all cybercrime; the scam economy aimed at individuals and companies sits on top of these numbers.
What defense looks like
Awais Rashid, a professor of cybersecurity at the University of Bristol, told Al Jazeera that digitising infrastructure raises the disruption risk, but that “the world works because cybersecurity works effectively”. The individual-level mitigations are unglamorous: strong passwords, retiring devices that no longer get updates, and — per the NCSC — switching off unused features like remote camera access. For the plant-level failures there is no consumer fix, which is why the UK’s Be Ready campaign, launched last month partly in response to cyber-threats, tells households to keep three days of water, food, medicine, cash and torches. The number that would tell us whether any of this is working — who ran the 2 November wave across nine countries — does not exist yet.