Hackers twice seized control of supermarket refrigeration units across Europe in under a month, triggering fires and spoiling millions of euros’ worth of food. On October 11 and 12, attackers heated units at approximately 700 French stores to temperatures as high as 50C (122F). A second wave of suspected cyberattacks struck supermarkets and food businesses in at least nine European countries on November 2.
The second wave affected Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden. France has since attributed the initial attack to Shahid Kaveh, a cyberunit affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). Officials described it as the first large-scale sabotage cyberattack on French soil, though the perpetrators of the second wave remain unidentified.
These incidents have intensified concerns regarding the vulnerability of internet-connected equipment, ranging from industrial machinery to household appliances. Supermarket fridges and freezers are typically managed via a single control panel connected to the internet for remote contractor access. Home smart fridges operate similarly, linking through Wi-Fi, mobile applications, or cloud services.
Reportedly, the attackers located these supermarket systems using Shodan, a search engine designed for internet-connected devices. Vincent Strubel, head of France’s National Cybersecurity Agency (ANSSI), stated that intruders exploited basic security failures to gain entry. Once inside, hackers can switch appliances off, raise temperatures, or steal account details.
In France, the attackers specifically utilised the controllers’ own defrost function to heat the units. A poorly protected fridge can also serve as a gateway to other devices on the same network, including laptops and smart locks. Speaking to the French Senate on October 21, Strubel warned that the healthcare sector uses identical equipment to store vaccines and hazardous materials.
He noted that this risk extends from research laboratories to pharmacies, implying that anything connected via the internet could potentially be hacked. According to Kepios’s Digital 2027 Global Overview Report, there are approximately 21 billion short-range connected devices, such as smartwatches, worldwide. Additionally, there are 5.4 billion long-range devices, including remote monitoring systems.
US internet households now average about 18 connected devices, nearly double the number recorded a decade ago, according to Parks Associates. Routers are among the primary targets because they remain online constantly. In April, the UK’s National Cyber Security Centre (NCSC) warned that hackers linked to Russia’s GRU military intelligence were hijacking home and small business routers.
By tampering with DNS settings, which convert website names into IP addresses, these hackers redirected users to fake websites to steal passwords and personal details. Smart TVs can also be compromised without owners’ knowledge. In June, researchers discovered that more than a third of apps on LG and Samsung smart TVs could allow strangers to secretly use a household’s internet connection.
This activity hides behind the home’s IP address, masking the intruder’s actions. Robot vacuums present further exposure; earlier this year, a programmer reportedly controlled almost 7,000 DJI Romo robot vacuums using a PlayStation 5 controller. Using Claude Code, an AI coding tool developed by Anthropic, he decoded how the vacuums communicated with DJI’s servers.
He subsequently gained access to live camera feeds, audio, and floor plans of people’s homes. The same vulnerabilities that expose a fridge can affect power plants, water supplies, banks, and hospitals. Many of these critical services are operated by industrial computers that are reachable online.
Since the US-Israel war on Iran began, US agencies have warned that Iran-affiliated hackers are targeting these systems.
In July, a cyberattack in the US state of Minnesota targeted more than 30 community water systems, according to the state’s IT agency. Officials suspected Iran-aligned hackers were responsible. The FBI and CISA warned that water and wastewater systems were increasingly being targeted, with facilities in 12 states affected at the time.
That same month, a cyberattack attributed to Iran-linked hackers forced a small British power plant offline for four days. It was reported as the first successful attack of its kind on UK energy infrastructure. The US Cybersecurity and Infrastructure Security Agency (CISA) lists sectors it considers critical infrastructure, highlighting the potential impact of hacks on daily life.
Banks are also significant targets. In late September and early October, hackers stole personal data from at least seven South Korean financial firms, affecting approximately 68,000 people. Yegaram Savings Bank and Shinhan Bank were hit hardest, with about 40,000 and 25,000 customers affected, respectively.
According to The Wall Street Journal, the attacker used ARTEX, an open-source AI tool developed in China, to test networks for weaknesses.
US cybersecurity firm CrowdStrike assessed, with moderate confidence, that the attacker was likely a China-based individual who also used Claude Code. The European Repository of Cyber Incidents (EuRepoC), a research database tracking political cyberattacks worldwide, logged 4,932 major incidents between January 2000 and November 2026. The number of incidents has grown sharply in recent years, peaking at 795 in 2024.
About two-thirds of all incidents recorded since 2000 have occurred since 2022. Governments remain the biggest target, with state institutions accounting for nearly 40 percent of all targets. This is led by the civil service and government ministries, followed by the military, police, political parties, and legislatures.
Critical infrastructure is the second most targeted sector, led by health, finance, telecommunications, transport, and energy. This is followed by defence firms, manufacturing, research, and digital service providers. Companies, schools, civil society groups, and media outlets make up most of the remaining targets.
EuRepoC tracks only politically significant attacks, which represent a fraction of all cyberattacks.
Beyond these, hackers often target individuals and companies with scams. They rely on weaknesses such as weak passwords and devices that no longer receive updates. Awais Rashid, a professor of cybersecurity at the University of Bristol, noted that as infrastructure becomes more digitised, the risk of disruption from cyberattacks has risen.
However, he added, “the world works because cybersecurity works effectively.” The UK’s NCSC also advises people to turn off unnecessary connected devices when not in use to reduce their digital footprint and potential exposure to malicious actors.
Reporting verified from official briefings and primary coverage by www.aljazeera.com.
Reader Discussion & Comments (0)
Join the conversation. All comments are moderated in accordance with our editorial standards.