In this post, I will show you what 700 hacked fridges teach about your router.
On 11 October 2026, someone logged into the refrigeration controllers of up to 700 French supermarkets and switched them to defrost, with the stock still inside. Cabinets that should sit near 4°C climbed towards 50°C. One store in Normandy recorded 80°C. Sprinklers went off, equipment melted, food spoiled, and the bill passed EUR 10 million. On 2 November it happened again, this time in Belgium, Luxembourg, Estonia, the Netherlands, Ireland and Sweden.
No zero-day. No nation-state magic. The controllers ran a small web server so they could be monitored remotely, many still accepted the username admin with a password derived from the current date, and two of the affected families had been end of life since 2016 and 2021. A known vulnerability, a default credential and hardware nobody wanted to replace. If you want the full timeline of both incidents and what the investigators found, the full timeline of the fridge attacks covers the controllers, the credentials and the response.
The interesting part is not the supermarkets. It is that the same three ingredients sit in almost every home in Britain.
Table of Contents
The attack was boring on purpose
Danfoss published an advisory in March 2025 and a fix in August 2025. Claroty had documented the flaw earlier that year. The controllers were reachable from the public internet because remote monitoring was sold as a feature, not an accident. Nobody patched, nobody retired the hardware, and a year later a stranger was turning supermarket freezers into heaters.
That is the pattern behind most successful intrusions, and it has nothing to do with sophistication. It is convenience left switched on, plus a device that outlived its support window.
Your home has the same shape, only smaller
The 2026 IoT Security Landscape Report, published by Bitdefender and NETGEAR on 28 October 2026, looked at telemetry from roughly 10.4 million smart homes between January and September. It analysed 5.4 billion security events and 1.2 billion vulnerability observations. The average connected home now runs 24 internet-capable devices, up from 22 a year earlier.
Three numbers from that report matter more than the rest. Reconnaissance accounted for 90.1% of detected attack activity, which means most traffic hitting a home network is automated scanning for weak spots. Smart TVs, smart plugs and network attached storage produced 67.1% of vulnerability observations, and those are exactly the devices people buy once and never think about again. And 99.97% of the observed vulnerabilities were publicly known CVEs. Almost nothing arriving at a home network is exotic. It is old and unpatched.
The router is the supermarket controller
A domestic fridge usually talks to a vendor cloud and sits behind your router, so the appliance itself is one step removed from the internet. The router is not. It is the front door, the DNS server, the firewall and the device that decides which gadget may talk to which.
When a router falls, the symptoms are quiet. Someone changes the DNS server and you land on a convincing copy of your bank’s login page while the address bar looks right. Someone enables remote management and now the admin panel answers from the internet. Someone maps a port with UPnP and an always-on device becomes reachable. None of this breaks your connection, which is why people notice months later, or never.
Botnets do not disappear, they rebuild
Cloudflare’s Q3 2026 DDoS report counted 18.2 million network-layer attacks in the quarter, roughly 8,226 every hour. Law enforcement dismantled four of the largest IoT botnets, Aisuru, KimWolf, JackSkid and Mossad, and hyper-volumetric attacks above 1 Tbps fell by nearly 69% as a result. New variants such as Dysphoria are already filling the gap.
The pool those botnets recruit from is the same pool the supermarket controllers came from, and it is the pool your fridge, television and vacuum cleaner sit in. Nothing about the next campaign requires a new technique.
Five checks worth doing this weekend
- Change the router admin password, not just the WiFi password. They are different logins, and most people never touch the first one.
- Turn off remote administration. Look for remote management, cloud management or web access from WAN, and disable it if you do not actively use it.
- Move to WPA3 and switch WPS off. The WPS PIN is brute-forceable, and convenience is not worth an open door.
- Put smart devices on a separate network. Most ISP routers offer a guest network with client isolation. Fridges, plugs, cameras and televisions belong there.
- Patch the router firmware, then replace the hardware when support ends. An end-of-life router is the domestic version of a 2016 refrigeration controller.
The UK already requires more than it did. Since 29 April 2024, the Product Security and Telecommunications Infrastructure Act has banned easily guessable universal default passwords on consumer connectable products, required a published vulnerability reporting route, and demanded transparency about support periods, with penalties reaching GBP 10 million or 4% of worldwide turnover.
That raises the floor for new hardware. It does nothing for the devices already on your shelf, and it does nothing for a router that was installed in 2019 and has never been updated. The French supermarkets had a public advisory and more than a year to act. Their freezers still ended up at 80°C.
Your kitchen is smaller. The mechanics are the same.
About the Author:
Meet Angela Daniel, an esteemed cybersecurity expert and the Associate Editor at SecureBlitz. With a profound understanding of the digital security landscape, Angela is dedicated to sharing her wealth of knowledge with readers. Her insightful articles delve into the intricacies of cybersecurity, offering a beacon of understanding in the ever-evolving realm of online safety.
Angela's expertise is grounded in a passion for staying at the forefront of emerging threats and protective measures. Her commitment to empowering individuals and organizations with the tools and insights to safeguard their digital presence is unwavering.
