Fridge hacks, a $6bn crypto heist and a fake nuclear alert signal a new hacking landscape, experts warn

Alex Pearce was doing morning rounds at his London fruit and vegetable wholesale business on Monday last week when he noticed the defrost light on refrigeration unit 2 was on, and the panel reading was 150C. Unit 4 showed the same. As he approached his biggest unit, its defrost light also blinked on. He walked to the box connecting the units to the internet and pulled the cable. He was right to suspect a cyber-attack.

That same day, retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported similar problems, with some refrigerators and freezers soaring to 50C. French blood banks were also hit. The cold storage hack was one of three major incidents in a matter of days. On 30 October, hackers stole $6.3bn from Binance, the world's largest cryptocurrency exchange - the biggest heist on record. On 1 November, a fake nuclear strike alert was pushed through Ukraine's emergency app to people in Kyiv.

Richard Horne, head of the UK's National Cyber Security Centre, said this week we are in the "foothills" of a new hacking environment. "There are so many vulnerabilities out there that … you could say are waiting to be exploited," he said. He added that the most serious short-term risk is "a huge rise in the volume of incidents … and I think you could probably point to the last few months and say we've started to see that."

AI is finding flaws faster than they can be fixed

Two forces are driving the NCSC warnings: geopolitics and artificial intelligence. Last month, websites around the world were temporarily taken offline as a precaution after AI technology from OpenAI helped discover a flaw in PHP, a computer language that underpins much of the web. French supermarket fridges were also attacked in what may have been a trial run for the broader assault the following week.

Tech entrepreneur Azeem Azhar called this a "Wuhan moment," likening AI's ability to surface vulnerabilities to the early days of a pandemic. Cybersecurity executive Matthew Prince said last month: "We're going to have a couple of years where every single week it's going to feel like the sky is falling."

Since April, when AI startup Anthropic released its Mythos model, which has a strong ability to flag IT flaws, the number of vulnerabilities found by leading tech companies has surged eight-fold. The NCSC said last week that AI-powered malicious software was "highly likely" to be used in attacks against UK power stations, airports and hospitals by 2028. The agency said AI would help attackers scout targets, locate network weaknesses and write malicious code.

But attacks have not risen by the same volume. Cybersecurity expert Tal Be'ery has speculated that criminal hackers are struggling to monetise these flaws, pointing to a recent decline in ransomware revenues. "It seems that currently the surge in vulns does not translate to a surge in breaches," he wrote last month.

Paul Chichester, the NCSC's director of operations, said the cold storage hackers "really didn't need" AI to find the fridge flaws. The vulnerabilities were already exposed, including default access passwords published in one fridge operating company's manuals. The Danish firm Danfoss, one of the affected system providers, said most of the targeted equipment was old and no longer received security updates.

A grey-zone conflict with state fingerprints

At least one expert said the fridge attacks bear Russian hallmarks. Xavier Bellekens, chief executive of cybersecurity firm Lupovis, said his startup set up "honeypot" traps using the same fridge controllers. The techniques used by the lured hackers included routing through internet service providers tolerant of malicious activity - a tactic linked to previous Russian operations. "Are we certain they are Russian groups? We are not. But elements of this point in that direction," he said.

The Binance hack has been attributed to North Korea, which has a well-established reputation for crypto theft as sanctions starve the regime of cash. Russia is naturally a suspect in the Ukraine emergency alert incident. Finland, which shares a 1,340km border with Russia, recorded nearly 21,000 cyber incidents last year targeting a population of under 6 million - up from about 13,000 in 2022. This year, hackers compromised up to 50,000 Finnish government mobile phones.

Samuli Bergström, vice-president of Helsinki-based WithSecure, said Russian state actors are not the only culprits. There is a vast, unseen economy of hackers: activists, mercenaries, and groups with loose state affiliations. "These attackers are mostly opportunistic," Bergström said. "When they see something that is facing the internet, they will probably attack it. [If you have a device] connected to the internet, you have to assume that it will be attacked, sooner or later."

Ciaran Martin, the NCSC's founding chief executive, pushed back on the "Wuhan moment" comparison. He pointed to the NotPetya and WannaCry attacks in 2017 and the ransomware surge in 2021. "It's a bad run, but it's not unprecedented," he said. "The idea that we are having a Wuhan moment is not true. We are having one of those waves of incidents that happen every few years."

The internet of vulnerable things

The fridge attacks targeted the companies that provide operating systems for commercial refrigeration units. These systems connect to the internet, giving hackers a remote access route. A key weakness was "end of life" products that no longer receive security updates. Ollie Whitehouse, NCSC's chief technology officer, said it was "quite clear" that internet-connected devices - from smart speakers to broadband routers - could be "susceptible" to hackers.

Pearce said his fridge monitoring system, installed in 2018, would need updating. "Have we learned a lesson? Yes," he said. "There is a vulnerability we probably should have been aware of, but luckily the ramifications for us were not severe." He has not reconnected the internet cable. He said even after the French fridge attacks last month, he did not expect his company to be next. "Hacking for the sake of being disruptive is a strange concept to most people."

The goal of state actors mounting these attacks may be more psychological than destructive, some officials said. Turning fridges into ovens or compromising a blood bank is dramatic and memorable. But those specific vulnerabilities are likely now patched. Software can be updated faster than physical infrastructure can be rebuilt. Still, many legacy systems remain exposed. "These attacks are more frequent, and they continue to happen," Bergström said.

Last month, the UK government launched its Be Ready campaign, urging people to stock three days' worth of food and bottled water in case of a cyber or other serious emergency. Defence Secretary Wes Streeting said the country needed to prepare for "state-sponsored terrorism" targeting everyday infrastructure. Whitehouse said people should be "more mindful, definitely," about the security of connected devices, though he stopped short of saying they should be worried.

Why this matters for IT, operations and security professionals

The convergence of AI-driven vulnerability discovery and state-backed aggression changes the threat calculus for any organisation managing internet-connected infrastructure. The fridge attacks succeeded not through sophisticated code but through unpatched, end-of-life equipment with default passwords still in place. For IT and operations teams, the immediate takeaway is a supply-chain audit: identify every connected device - refrigeration units, building management systems, smart sensors - and verify that each one receives active security updates. Manufacturers need to invest more in product security, and procurement decisions should weigh lifecycle support as heavily as upfront cost. Professionals responsible for cybersecurity strategy can find structured training on these emerging threats through AI Security Analytics Courses, while leadership teams shaping organisational response may benefit from AI IT Strategy Training.