When even our fridges are ‘online’, a meltdown is inevitable

High schools aren’t the only things on fire in France right now. This week, fridges and freezers in hundreds of supermarkets were targeted by unknown hackers in a cyberattack. Internal thermostats were cranked up as high as 50 degrees Celsius, sparking fires and melting countless glaces and bâtonnets de poisson. Tonnes of products have had to be dumped, causing tens of millions of euros’ worth of damage. Supermarket chains – including Intermarché and Monoprix – were among those impacted.

As yet, nobody knows who the hackers were. It could have been bored teenagers, or it could have been a hostile nation-state, like Russia. Perhaps a far bigger question than who did it, however, is why on Earth people are connecting fridges and freezers to the internet in the first place.

Such technologies are sold as cost-effective and convenient. Live monitoring of freezer units allows temperatures to be raised or lowered remotely, potentially saving electricity costs for supermarket bosses. According to Danfoss, the Danish company that supplied the hacked software for most affected fridges, ‘automatic and remote monitoring services deliver cost savings through performance optimisation, reduced energy consumption, and fewer service calls’.

Alternatively, you could just have an employee check the Calippos were still solid and then fiddle about with the knobs every so often, which always worked perfectly well until about five minutes ago. Yet plenty of firms across Europe have drunk the Kool-Aid of Danfoss’s technology, despite the fact that such short-term penny-pinching has only ended up costing those who bought into it much more in the end.

This kind of folly is called ‘increasing the attack surface’ by sceptical cybersecurity experts, as in needlessly exposing all kinds of everyday objects and services to the ever-growing danger of computer hacking. Nerds like those at America’s National Institute of Standards and Technology have been warning for years that firms should do their best to minimise the potential attack surface able to be exploited by hackers, not increase it.

Our stubborn refusal to heed these warnings is becoming harder to justify. Cyberattacks on London hospitals and GP surgeries in 2024 caused the death of at least one person. In 2021, there was an attempt to sabotage a treatment plant for drinking water in Florida. In that case, hackers gained access to the plant’s software and increased the amount of sodium hydroxide in the treatment process. The change was detected before it became a public-health crisis – but was it really worth the peril? Robots delivering medicine in hospitals have already been shown to be vulnerable to hacking, possibly allowing evildoers to manipulate patients’ doses and pills. Why not just employ a human nurse instead?

Nevertheless, governments around the world continue to make themselves – and as a result, their populations – easy targets. German finance minister Lars Klingbeil is pushing ahead with new legislation to forcibly replace every last one of the nation’s previously manually operated offline cash registers with fancy new electronic web-linked ones, to ‘improve record keeping and combat tax evasion’. Once again, it all sounds very convenient… until someone in a Moscow basement inevitably breaks into them and wipes all the accounts clean.

Of course, governments aren’t alone in their vulnerability to all kinds of gimmicks. Our growing laziness as a society is certainly playing a role, too. In 2020, security researchers hacked into a web-connected coffee machine and caused it to spew out boiling-hot water on command. Then they caused the machine to demand a ransom – via a pixelated image of a devil’s face, which was projected on to the coffee machine’s display screen. All very inconvenient – and for what? The privilege of being able to command the thing to brew you a piping-hot cappuccino via your iPhone while you’re out of the house? Why?

In another case, an internet-connected fish tank in a casino was infiltrated as a staging point to access all the building’s other computer systems and steal data about matters rather more important than the precise temperature of water a spotted guppy likes to nibble its fish flakes in.

The prize for the most unnecessary increase of the ‘attack surface’ has to go to the manufacturers of a remote-controlled ‘male chastity’ lock. The ‘Cellmate Chastity Cage’, designed by Chinese company Quiu, is supposedly a way for ‘owners to give a partner control over access to their body’. In 2020, it was revealed that, as the locks had no manual override, the only way to remove them in the event of a hack was by the use of bolt-cutters or grinders.

Stephen King’s terrible 1986 movie, Maximum Overdrive, in which the world’s machines miraculously come to life and start killing people, may not be here yet. But if easily hacked hospitals and overheating fridges are anything to go by, we might be closer to meltdown than we think.