01Two kinds of computer, one set of problems
IT (information technology) is the laptops, servers and phones that hold data; it gets patched on a schedule and is watched by security teams. OT (operational technology) is the computers that run physical things: refrigeration controllers, factory robots, building HVAC, pipeline pumps. IoT (the internet of things) is the consumer and light-industrial version: cameras, smart plugs, DVRs, routers. OT and IoT are built for uptime and low cost. Security was historically someone else's problem because these devices sat on private networks.
Then they were connected, usually because it saved money: a technician can fix a cold room from a laptop rather than a truck. The fridge-hacking attacks of 2026 are a clean example. Per TIME, supermarkets use central control panels for refrigeration and many are internet-connected so maintenance firms can reach them. See the full story.
02Why these devices are the easy target
- Long lives, short support. A controller bought for a store refit may run for fifteen years; the vendor may stop issuing updates long before. In the French fridge case Danfoss said the affected units “were running outdated firmware”, and it had advised customers to migrate legacy systems (the company's account, per TIME).
- Default or weak passwords. The 2016 Mirai botnet scanned the internet for devices with factory-default logins. Flashpoint researchers found it was built largely from hacked DVRs and IP cameras (reported by Krebs on Security), and it took down the DNS provider Dyn on 21 October 2016, knocking Twitter, Netflix, Reddit, Spotify and PayPal offline for hours, per contemporary reports.
- Management pages left open to the internet. Internet-wide scans find them. A UK Cyber Defence exposure report cited by TIME found France held nearly 60% of the exposed Danfoss controllers it detected.
- Nobody is watching. A freezer controller has no security operations team. The French attackers reportedly extended defrost cycles from one hour to eight to delay the alarm (Le Monde, via TIME), because a defender who is not looking will not notice.
- Edge devices are now the main door. Verizon's 2025 Data Breach Investigations Report found edge devices and VPNs made up 22% of vulnerability-exploitation targets, up from 3% the year before, and that vulnerability exploitation was the initial access vector in 20% of breaches (credential abuse was 22%).
03Why it keeps getting worse
Each new connected device adds an attack surface faster than anyone adds a defender. And a hacked device is rarely the goal: it is a stepping stone (a camera in a botnet), a sensor (a building system that maps a network), or a weapon (a controller told to overheat food). Attackers no longer need to be experts, either: tools that scan the internet for exposed devices are free, and AI makes working out how to use a discovered flaw faster. See how AI is making cyberattacks faster and cheaper.
04What actually helps
- 01Take management interfaces off the public internet; use a VPN or an allow-list of trusted addresses (CERT-FR's advice for the Danfoss case).
- 02Change every default password; use unique credentials per device.
- 03Keep an inventory. You cannot patch what you do not know you have.
- 04Update firmware, and retire hardware the vendor no longer supports.
- 05Segment the network so a compromised controller cannot reach payments or customer data.
- 06Alert on out-of-range behaviour (a freezer at 50°C) through a channel that does not depend on the compromised system.
More in how to defend against cyberattacks: what actually works.
05Sources
Questions
- What is the difference between IT, OT and IoT?
- IT is the computers that process data (laptops, servers). OT is the computers that control physical processes (refrigeration, factory machines, pumps). IoT is the wider category of small internet-connected devices such as cameras and smart plugs. OT and IoT are typically patched less often than IT.
- Why are fridges and cameras easy to hack?
- They are built to run unattended for years, often ship with default passwords, are sometimes left reachable from the internet, and may no longer receive security updates, so a known flaw can stay open for a long time.
- What was the Mirai botnet?
- Malware that scanned the internet for devices, mainly cameras and DVRs, with default logins and enlisted them in a botnet. A Mirai botnet took part in the 21 October 2016 attack on DNS provider Dyn, which took many major websites offline for hours.
Keep reading
- Someone is hacking supermarket fridges: what we know about the attacks across EuropeHackers pushed supermarket fridges and freezers to 50°C in France in October and across Belgium, Sweden, Ireland and Estonia on 2 November 2026. What happened, how, and why it matters.
- Pipelines, power and water: why critical infrastructure is a cyber targetFrom the Colonial Pipeline shutdown to Volt Typhoon's pre-positioning in water and power networks: why attacks on infrastructure are rising and what they mean.
- How to defend against cyberattacks: the checklist that matches how attacks actually happenA short, evidence-based defence checklist for a business or shop: exposure, patching, MFA, backups, verification, supplier risk and payment controls, drawn from real 2024–2026 incidents.
- How AI is making cyberattacks faster, cheaper and harder to spotAI is speeding up phishing, reconnaissance and exploitation. What CrowdStrike's 2026 report and Anthropic's disclosed AI-run espionage campaign actually show, and what is hype.