The European Union’s (EU) cyber chief has urged Europe to prepare for attacks against routers and home appliances after a recent spree of hacks against supermarket fridges was pinned on Iran.

Last week, food retailers in at least nine European countries reported overnight temperature spikes on their fridges and freezers, forcing some stores to discard food and temporarily pull products from their shelves.

The attacks – which caused temperatures to climb as high as 70°C after hackers remotely toggled unit evaporators to defrost mode – followed a similar campaign that affected 700 French supermarkets in early October.

With November’s hacks surfacing a fresh wave of victims in the UK, Belgium, Ireland, Sweden, and more, Juhan Lepassaar, executive director of the EU's cybersecurity agency ENISA, warned future attacks may not be limited to fridges alone.

"Today it was fridges, tomorrow it could be routers, the day after tomorrow it could be home appliances, and so forth,” Lepassar told Agence France-Presse.

“Every single service that you are depending on as a citizen, as a human being, contains a layer whereby there is a digital element in it, a piece of code which if not protected can be hacked.”

Similar sentiments were echoed by Australia’s cybersecurity minister Tony Burke, who recently warned that “if you have a connected device, then you potentially have a hackable device”.

“Europe has seen that with respect to refrigeration,” Burke said at a Tuesday press conference.

Lepassaar noted cybersecurity is “not cheap” but ultimately called for greater investment from both manufacturers and European governments.

“Security should not and cannot be an afterthought.

"All incidents can be avoided, but the question is, are we ready to invest to make it happen?”

France points the finger at Iran

France was worst affected by the fridge hacks.

Local media reported millions of euros worth of food was discarded during the initial attacks in October, while fires were triggered in some 15 locations due to fridges overheating.

November’s follow-up attacks later impacted refrigerators at three regional blood banks, though the French Blood Establishment ultimately reported no effect on blood supplies.

EU authorities warn appliances could be next. Photo: Shutterstock

On Monday, French authorities accused Iran’s military cyber unit the Islamic Revolutionary Guard Corps of being behind the October attacks.

French foreign minister Jean-Noël Barrot described October’s fridge outages as the “first large-scale cyberattack” carried out for sabotage purposes on French territory and said those responsible would be hit with sanctions.

Iran has meanwhile rejected France’s allegations as “baseless and hostile”.

“[The accusations are] intended to divert public opinion from France’s destructive policies toward Iran,” Iran’s Foreign Ministry said Tuesday.

Is AI putting everyday devices at risk?

Though authorities have not disclosed how hackers made their way into European fridges, French cybersecurity agency ANSSI confirmed October’s attackers had targeted fridge controllers from Danish manufacturer Danfoss, US company Copeland, and one of its affiliate brands, Dixell.

Research firm Claroty said it had uncovered Danfoss and Copeland device vulnerabilities weeks before Europe’s fridge attacks and could exploit them in less than 30 minutes using a common AI tool.

“This vulnerability is not exclusive to Danfoss and Copeland,” wrote Claroty.

“Controllers from other vendors are critical in healthcare environments.

“Imagine how a forced defrost or thermal drift would wreck damage on high-value medicine and halt patient care.”

Gary Barlet, public sector chief technology officer at cybersecurity firm Illumio, told Information Age that AI is indeed making it “faster and easier” for attackers to identify vulnerable devices and exploit them at scale.

He noted that Internet of Things (IoT) devices – such as smart-home products, consumer wearables, and connected refrigerators – are particularly attractive to attackers given they are “often poorly secured, rarely updated, and largely overlooked”.

“Vulnerabilities and poor security practices have existed for years, but AI increases the speed and scale of the exploits of these devices,” Barlet explained.

“Security needs to be built into devices from the outset, with regular updates and secure configurations.”

“Consumers shouldn’t have to be cybersecurity experts just to use a connected appliance safely.”

Nalin Arachchilage, associate professor in cybersecurity at RMIT University, added that IoT devices offer an attractive pathway for nation-state actors.

“The ease with which IoT devices can be deployed poses a significant risk,” said Arachchilage, adding that although a single smart appliance may appear insignificant, large numbers of compromised devices can form powerful botnets to launch coordinated attacks or provide access to more valuable targets.

A network attack in May saw Australian hosting giant VentraIP flooded with traffic from usurped Australian home devices.

Arachchilage added that hacked IoT devices can be used for espionage, disruption, intelligence collection, or as entry points into larger networks and critical infrastructure.

“In my view, nation-state threat actors don’t need to take down a power grid to cause fear,” he said.

“Spoiling the food on supermarket shelves gets the message across.”