Alex Pearce noticed the defrost light on his London fruit wholesale unit glowing at 150C on a Monday morning. He yanked the internet cable immediately. On that same day, retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported similar failures, with some freezers reaching 50C. These incidents formed part of a three-day cluster of attacks that also included a $6.3bn theft from Binance on 30 October and a fake nuclear strike alert sent to Kyiv residents on 1 November. Richard Horne, head of the UK’s National Cyber Security Centre, declared we are in the "foothills" of a new hacking landscape where AI exposes flaws faster than developers can patch them. The NCSC warns that AI-powered malicious software is "highly likely" to target power stations, airports and hospitals by 2028.
Vulnerabilities exposed by AI
The surge in discovered vulnerabilities follows the release of Anthropic’s Mythos model in April, which has increased the number of flaws found by leading tech companies eight-fold. However, Tal Be’ery notes that this spike does not translate into more breaches because criminal hackers struggle to monetize these specific weaknesses. The fridge attacks targeted operating systems for commercial refrigeration units connected to the internet. Danfoss, an affected provider, stated most equipment was old and no longer received security updates. It had "long recommended" customers install updates or replace obsolete software. Paul Chichester, NCSC director of operations, said the attackers "really didn’t need" AI because default access passwords were already published in manuals. This lack of basic security is a clear failure of manufacturers who leave end-of-life products exposed.
Sophos reported no major client incidents related to the PHP glitch but saw significant attempts to exploit it. Ciaran Martin, founding chief executive of NCSC, dismissed the "Wuhan moment" comparison as false. He pointed to NotPetya and WannaCry in 2017 and the 2021 ransomware surge as evidence that such waves happen every few years. Yet the geopolitical context has shifted. Xavier Bellekens, CEO of Lupovis, set up honeypots using the same fridge controllers and found techniques linked to Russian actors. He noted they used internet service providers tolerant of malicious activity. While attribution remains uncertain, elements point in that direction. In Finland, national cybersecurity centres recorded nearly 21,000 incidents last year, up from about 13,000 in 2022. Hackers compromised up to 50,000 Finnish government mobile phones this year. Samuli Bergstrom of WithSecure explained that attackers are mostly opportunistic and will hit any device facing the internet.
The grey zone threat
The UK government launched the Be Ready campaign last month, urging citizens to stock three days of food and nine litres of water. Defence Secretary Wes Streeting cited the threat of "state-sponsored terrorism" targeting everyday infrastructure. Ollie Whitehouse, NCSC chief technology officer, said it is "quite clear" that smart speakers and broadband routers are susceptible to hackers. Manufacturers must invest more in security, and consumers must pay more for robust products. Pearce now knows his Copeland system, installed in 2018, needs updating. He admitted there was a vulnerability they should have been aware of, but luckily the ramifications were not severe. The goal for state actors may be psychological rather than destructive. Turning fridges into ovens sears itself into memory, but those specific vulnerabilities are likely patched now. There is no guarantee a criminal group can mount that exact attack again. Still, legacy systems remain open doors. Bergstrom emphasized that if a device is connected to the internet, you must assume it will be attacked sooner or later. Software patches quickly, unlike physical grid damage, but the frequency of incidents continues to rise. We face a vast, unseen economy of hackers with loose state links. The risk is not a single catastrophic blackout but a constant stream of disruptions that erode trust in digital infrastructure.
