# Why everything with a network cable ends up hacked: IoT and OT explained

> A freezer controller, a security camera and a pipeline valve share three traits: they were designed to run for years, they were connected for convenience, and they rarely get updated. That combination is why attackers keep reaching for them. Here is how it works and why it is getting worse as more things come online.

Updated 2026-11-03 · Payaries · https://www.payaries.com/blog/why-everything-connected-gets-hacked

## Two kinds of computer, one set of problems

> **Written 3 November 2026.** Payaries is a technology platform, not a security adviser. This article reports public information and is not legal or security-consulting advice. Facts in fast-moving stories change — read the primary sources linked below.

**IT** (information technology) is the laptops, servers and phones that hold data; it gets patched on a schedule and is watched by security teams. **OT** (operational technology) is the computers that run physical things: refrigeration controllers, factory robots, building HVAC, pipeline pumps. **IoT** (the internet of things) is the consumer and light-industrial version: cameras, smart plugs, DVRs, routers. OT and IoT are built for uptime and low cost. Security was historically someone else's problem because these devices sat on private networks.

Then they were connected, usually because it saved money: a technician can fix a cold room from a laptop rather than a truck. The fridge-hacking attacks of 2026 are a clean example. Per TIME, supermarkets use central control panels for refrigeration and many are internet-connected so maintenance firms can reach them. See the [full story](https://www.payaries.com/blog/supermarket-fridge-cyberattacks-europe-2026).

## Why these devices are the easy target

- **Long lives, short support.** A controller bought for a store refit may run for fifteen years; the vendor may stop issuing updates long before. In the French fridge case Danfoss said the affected units “were running outdated firmware”, and it had advised customers to migrate legacy systems (the company's account, per TIME).
- **Default or weak passwords.** The 2016 Mirai botnet scanned the internet for devices with factory-default logins. Flashpoint researchers found it was built largely from hacked DVRs and IP cameras (reported by Krebs on Security), and it took down the DNS provider Dyn on 21 October 2016, knocking Twitter, Netflix, Reddit, Spotify and PayPal offline for hours, per contemporary reports.
- **Management pages left open to the internet.** Internet-wide scans find them. A UK Cyber Defence exposure report cited by TIME found France held nearly 60% of the exposed Danfoss controllers it detected.
- **Nobody is watching.** A freezer controller has no security operations team. The French attackers reportedly extended defrost cycles from one hour to eight to delay the alarm (Le Monde, via TIME), because a defender who is not looking will not notice.
- **Edge devices are now the main door.** Verizon's 2025 Data Breach Investigations Report found edge devices and VPNs made up 22% of vulnerability-exploitation targets, up from 3% the year before, and that vulnerability exploitation was the initial access vector in 20% of breaches (credential abuse was 22%).

## Why it keeps getting worse

Each new connected device adds an attack surface faster than anyone adds a defender. And a hacked device is rarely the goal: it is a **stepping stone** (a camera in a botnet), a **sensor** (a building system that maps a network), or a **weapon** (a controller told to overheat food). Attackers no longer need to be experts, either: tools that scan the internet for exposed devices are free, and AI makes working out how to use a discovered flaw faster. See [how AI is making cyberattacks faster and cheaper](https://www.payaries.com/blog/how-ai-is-making-cyberattacks-faster-and-cheaper).

## What actually helps

1. Take management interfaces off the public internet; use a VPN or an allow-list of trusted addresses (CERT-FR's advice for the Danfoss case).
2. Change every default password; use unique credentials per device.
3. Keep an inventory. You cannot patch what you do not know you have.
4. Update firmware, and retire hardware the vendor no longer supports.
5. Segment the network so a compromised controller cannot reach payments or customer data.
6. Alert on out-of-range behaviour (a freezer at 50°C) through a channel that does not depend on the compromised system.

More in [how to defend against cyberattacks: what actually works](https://www.payaries.com/blog/how-to-defend-against-cyberattacks-what-works).

## Sources

- [‘Unprecedented’ cyberattack targets French supermarket fridges — TIME](https://time.com/article/2026/10/13/france-cyber-attack-cybersecurity-refrigeration-supermarket-food-security/)
- [Hacked cameras, DVRs powered today's massive internet outage — Krebs on Security (21 Oct 2016)](https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/)
- [Verizon 2025 Data Breach Investigations Report](https://verizon.com/about/news/2025-data-breach-investigations-report)

## Questions

**What is the difference between IT, OT and IoT?**
IT is the computers that process data (laptops, servers). OT is the computers that control physical processes (refrigeration, factory machines, pumps). IoT is the wider category of small internet-connected devices such as cameras and smart plugs. OT and IoT are typically patched less often than IT.

**Why are fridges and cameras easy to hack?**
They are built to run unattended for years, often ship with default passwords, are sometimes left reachable from the internet, and may no longer receive security updates, so a known flaw can stay open for a long time.

**What was the Mirai botnet?**
Malware that scanned the internet for devices, mainly cameras and DVRs, with default logins and enlisted them in a botnet. A Mirai botnet took part in the 21 October 2016 attack on DNS provider Dyn, which took many major websites offline for hours.

## Try it

Run a real invoice before you commit: [Payaries — www.payaries.com](https://www.payaries.com/signup). Payaries is a multi-chain crypto payment gateway — https://www.payaries.com

## Keep reading

- https://www.payaries.com/blog/supermarket-fridge-cyberattacks-europe-2026 — Someone is hacking supermarket fridges: what we know about the attacks across Europe
- https://www.payaries.com/blog/critical-infrastructure-cyberattacks-explained — Pipelines, power and water: why critical infrastructure is a cyber target
- https://www.payaries.com/blog/how-to-defend-against-cyberattacks-what-works — How to defend against cyberattacks: the checklist that matches how attacks actually happen
- https://www.payaries.com/blog/how-ai-is-making-cyberattacks-faster-and-cheaper — How AI is making cyberattacks faster, cheaper and harder to spot