Hot fridges, a fake nuclear alert and a $6bn heist: are we in the foothills of a hacking epidemic?

Attacks on refrigeration systems, a fake nuclear alert in Kyiv and a record cryptocurrency heist have renewed warnings cyber threats – but experts differ on whether the incidents signal a new phase.

Last Monday, London fruit and vegetable wholesaler Alex Pearce noticed that two refrigeration units showed defrost lights and readings of 150C. The light on his largest unit then came on too. Suspecting a cyberattack, he unplugged the box connecting the units to the internet.

This is reported by The Guardian .

Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported similar problems that day. In some shops, refrigerators and freezers reached temperatures as high as 50C (122F). French blood banks have also been affected. “If it had happened on a Saturday morning, when I don’t tend to be here, it could ultimately have led to a fire,” Pearce said.

The refrigerator attacks were one of three cyber incidents reported over several days. On 30 October, hackers stole $6.3bn (£4.7bn) from Binance, the world’s largest cryptocurrency exchange, in a record heist. On 1 November, hackers targeted Ukraine’s emergency alert app, sending people in Kyiv a fake nuclear strike warning.

The UK’s National Cyber Security Centre (NCSC) has warned that more disruption should be expected. Its chief, Richard Horne, said this week that the world was in the “foothills” of a new hacking landscape. Referring to weaknesses in IT systems exposed by AI, he said: “There are so many vulnerabilities out there that … you could say are waiting to be exploited.”

Photo: Alex Pearce unplugged the internet at his wholesale fruit and vegetable business after seeing the temperature of the refrigeration units shoot up. Source: Martin Godwin/The Guardian.

Horne added: “The most serious risk we face in the short term is just a huge rise in the volume of incidents … and I think you could probably point to the last few months and say we’ve started to see that.”

Last month, websites around the world were temporarily taken offline as a precaution after AI technology from OpenAI helped find a flaw in PHP, a programming language used to build much of the web. French supermarket refrigerators were also attacked last month, in what may have been a trial run for this week’s wider incident.

Photo: Hackers targeted Ukraine’s emergency alert app this month to send warnings to people in Kyiv. Source: Roman Pilipey/AFP/Getty Images.

Tech entrepreneur and commentator Azeem Azhar compared AI models finding flaws that attackers could exploit to the start of the Covid outbreak in China, calling it a “Wuhan moment”. His Substack post also quoted cybersecurity executive Matthew Prince, who said last month: “We’re going to have a couple of years where every single week it’s going to feel like the sky is falling.”

Photo: Boxes of perished goods outside an Intermarché in Paris last month after a cyber-attack that could have been a trial run for this week’s foray. Source: Lucien Libert/Reuters.

Geopolitics and AI are behind the NCSC’s warnings. At least one expert said the refrigerator attacks bore Russian hallmarks. The Binance hack has been attributed to the North Korean state, while Russia is a suspect in the attack on Ukraine’s alert app.

The NCSC said last week that AI-powered malicious software was “highly likely” to be used by 2028 in hacking attacks against UK power stations, airports and hospitals. AI could help attackers scout targets, find weaknesses in IT networks and write malicious code, the agency said.

There are, however, qualifications to the warnings. NCSC director of operations Paul Chichester said the attackers targeting cold-storage systems “really didn’t need” AI to find the vulnerabilities: some, including default access passwords, had already been published in a refrigeration company’s manuals. Cybersecurity firm Sophos said it had seen no major incidents among its clients related to the PHP flaw, although it had recorded a significant number of attempts to exploit it.

Photo: Why are fridges being hacked and what could be ? – The Latest. Source: The Guardian.

Ciaran Martin, the NCSC’s founding chief executive, said the “Wuhan moment” comparison went too far. He pointed to the NotPetya and WannaCry attacks in 2017, blamed on Russia and North Korea respectively, and a rise in ransomware attacks in 2021. North Korea, he said, has a well-established reputation as a cryptocurrency hacker. “It’s a bad run, but it’s not unprecedented,” Martin said. “The idea that we are having a Wuhan moment is not true. We are having one of those waves of incidents that happen every few years.”

Photo: Ciaran Martin, the founding chief executive of the NCSC, has played down the gravity of the moment. Source: Wolfgang Rattay/Reuters.

Since Anthropic released its Mythos model in April, leading technology companies have found eight times as many vulnerabilities. But attacks have not grown by the same amount. Cybersecurity expert Tal Be’ery has suggested that criminal hackers are finding it difficult to make money from the flaws, pointing to a recent decline in ransomware revenues. “It seems that currently the surge in vulns [vulnerabilities] does not translate to a surge in breaches,” he wrote last month.

The attacks on refrigerators exploit weaknesses in the companies’ operating systems for commercial refrigeration units. Because the systems connect to the internet, attackers can reach the equipment remotely. Danish firm Danfoss, one of the affected providers, said most of the equipment was old and no longer received security updates. It said it had “long recommended” that customers install updates or replace obsolete software.

The NCSC, part of the GCHQ intelligence agency, said the attacks highlighted the vulnerability of everyday internet-connected devices, from smart speakers to broadband routers. Its chief technology officer, Ollie Whitehouse, said this week it was “quite clear” such devices could be “susceptible” to hackers. Manufacturers need to invest more in product security and consumers need to be willing to pay more for robust products and keep them updated.

A key weakness targeted by hackers is “end of life” software – products no longer made or supported with security updates. Asked the prospect of more attacks on connected household devices, Whitehouse said: “To be worried, I think, is [too] strong. But we need to be more mindful, definitely.” Pearce said he now understood that his refrigeration monitoring system, made by the US firm Copeland and installed in 2018, needed an update.

Photo: The hacks are a reminder of the vulnerability of everday objects with internet access, experts say. Source: Fred Tanneau/AFP/Getty Images.

“Have we learned a lesson? Yes,” Pearce said. “There is a vulnerability we probably should have been aware of, but luckily the ramifications for us were not severe.” The threat also comes from nation states. Criminal groups use ransomware to encrypt victims’ files and demand cryptocurrency to unlock them, but governments also operate on the cyber front line. Russia’s hybrid warfare campaign against Europe has made this grey zone a particular concern.

Photo: Alex Pearce says he now realises his fridge monitoring system will need updating.

Last month, the UK government launched its Be Ready campaign, urging people to keep three days’ worth of food and up to nine litres of bottled water in case of a weather, cyber or other serious emergency. Defence Secretary Wes Streeting said the country needed to prepare for the threat of “state- terrorism” targeting everyday infrastructure.

Photo: Geopolitics, exemplified by Russia’s hybrid warfare campaign against Europe, have made the cyber frontline a particular source of concern. Source: AP.

Xavier Bellekens, chief executive of cybersecurity firm Lupovis, said his startup had set up “honeypot” traps using the same refrigerator controllers targeted in Europe. The hackers drawn to the traps used internet service providers particularly tolerant of malicious activity – a tactic linked to malicious activity by Russians. “Are we certain they are Russian groups? We are not. But elements of this point in that direction,” he said.

In Finland, officials and experts said the refrigerator attacks were no surprise, but part of a pattern they had watched grow for years. Finland shares a 1,340km (832 mile) border with Russia. Since Russia’s 2022 invasion of Ukraine, cyberattacks of all kinds have escalated. The country’s national cybersecurity centre recorded nearly 21,000 incidents last year, targeting a population of fewer than 6 million; in 2022, it recorded 13,000. This year, hackers compromised up to 50,000 Finnish government mobile phones. Last year, they took down the defence ministry’s website.

Photo: Freezers at a supermarket in Sweden are emptied after temperatures reached 50C. Photograph: Johan Nilsson/TT/Shutterstock. Source: The Guardian.

The rise is evident across Europe and Nato countries, but is especially pronounced in countries bordering Russia. Samuli Bergström, vice-president of Helsinki-based cybersecurity company WithSecure, said Russia was not the only factor: AI was also boosting attacks, and internet-connected appliances were at risk. “These attackers are mostly opportunistic,” he said. “When they see something that is facing the internet, they will probably attack it. [If you have a device] connected to the internet, you have to assume that it will be attacked, sooner or later.”

Bergström and others also cautioned that Russian state actors were not the only attackers, or necessarily the most sophisticated. The global hacking economy includes activists and mercenaries, some with links to states such as Russia and Iran. Those links can be loose, making it difficult for officials to establish the motive behind a particular attack.

Europe’s countries have plans for disruptions to payment systems and attacks on power grids. But cyberattacks are not the same as physical war: bombing a power station could disable a grid for months or longer, given the years-long wait to buy transformers. Software can be patched more quickly, and devices can usually be disconnected from the internet.

Photo: He has not reattached the internet cable but said his business is otherwise unaffected. Source: The fridge control panel at Alex Pearce’s London warehouse.

Some officials said the aim of cyberattacks by state actors could be psychological. Turning refrigerators into ovens or compromising a blood bank makes a vivid impression, but the vulnerabilities involved are likely to be patched. There is no guarantee that a criminal group could carry out the same attack again. Other weaknesses and legacy systems remain exposed, Bergström said: “These attacks are more frequent, and they continue to happen.”

Pearce has not reconnected the internet cable, but said his Langridge Organic business was otherwise unaffected. Even after the French refrigerator attacks last month, he had not expected his company to be targeted. “Hacking for the sake of being disruptive is a strange concept to most people.”

We recommend paying attention to:

A Pentagon personnel system breach exposed unencrypted personal records of 2.8 million living people and nearly 300,000 deceased, including Social Security numbers and military service details.

US stock indexes closed mixed amid government shutdown risks, with Dow Jones rising and Nasdaq falling slightly as investors weigh economic uncertainty and AI optimism.

Dubai-registered crypto exchange Shelbit processed at least $4 billion in digital assets and is under investigation over alleged Iranian sanctions evasion and money laundering.