French authorities have stated that the refrigeration and freezing equipment of hundreds of supermarkets were targeted in a cyber attack, sounding an alarm for everyone and highlighting the core issue of food safety. This incident has led many people to wonder, “Can hackers invade my refrigerator too?” And which household devices are susceptible to hacking?
From refrigerators, heating systems to surveillance cameras and alarm systems, more and more devices can now be remotely monitored and controlled through the internet, providing new opportunities for cybercriminals. In the recent incident, hackers raised the temperature of refrigeration and freezing equipment in French supermarkets to as high as 50 degrees Celsius (122 degrees Fahrenheit) overnight, causing equipment fires, forcing supermarkets to discard a large amount of food, and raising concerns about the cybersecurity of home devices.
Here are some questions compiled by Reuters that everyone is concerned about.
In theory, it is possible. As long as the device is connected to the internet — whether directly connected or through applications, cloud services, or home networks — it is susceptible to hacking.
In 2015, researchers at a hacker conference in Las Vegas demonstrated how they could hack into a Samsung smart refrigerator, intercepting some of the network traffic transmitted through the device.
In many cases, attackers are more interested in stealing data, disrupting services, or using internet-connected devices as a stepping stone to invade larger networks.
The most common targets for hackers are internet-connected devices that can be remotely controlled.
These devices include security cameras, smart doorbells, alarm systems, smart locks, thermostats, and central heating systems. Even smart appliances such as refrigerators, ovens, and washing machines could be at risk of hacking if connected to the external internet. Nowadays, even some toothbrushes have internet connectivity.
According to data from the cybersecurity industry, in more than three-quarters of attacks targeting connected devices, the main target is routers, not household appliances.
As manufacturers add internet connectivity to products that previously relied solely on mechanical operation, the number of connected devices is rapidly increasing.
Once a device is successfully hacked, hackers can typically perform two types of operations: gather information or control the device.
Cameras may allow hackers to spy on the home, devices equipped with microphones may be used for eavesdropping, and hacked routers may expose all information transmitted through that network.
After gaining control of a device, hackers can turn it on or off, change settings, or prevent users from logging into their accounts. A hacked thermostat could affect the operation of the heating system, while a compromised fridge or freezer could disrupt temperature control functions. In more severe cases, attackers could use vulnerable devices to further infiltrate other systems in the same network or steal personal information related to network accounts.
Cybersecurity researchers have repeatedly demonstrated vulnerabilities in connected cars. In 2015, researchers remotely controlled a moving car through its internet-connected entertainment system, prompting the car manufacturer to recall about 1.4 million vehicles and introduce software patches.
Nearly a decade later, researchers disclosed another security flaw that allowed them to track, unlock, and start some Kia vehicles with just the license plate number. They reported these vulnerabilities to Kia, which fixed them within a few months, and there is no evidence that these flaws were exploited in actual attacks.
Critical infrastructure such as power and water networks typically have multiple layers of security defenses, monitoring, and regulatory mechanisms, which consumer devices generally lack. This does not mean that critical infrastructure is immune to network attacks, but they are typically harder targets to breach compared to household appliances connected to home Wi-Fi networks.
Cybersecurity experts typically recommend changing the default passwords of devices, enabling two-factor authentication where supported, and regularly installing software updates.
Consumers should also remove or replace devices that no longer receive security updates, and try to keep most devices connected only to the local network, connecting to the external internet only when necessary.
The simplest principles are often the most effective: the fewer connected devices, the fewer entry points attackers may exploit.