Employees empty perishable goods from freezers at a supermarket in Sjoebo, Sweden, on Monday after a hacker attack on refrigeration systems that affected several countries in Europe. | AFP-JIJI
Last week, Binance, the world’s largest crypto exchange, revealed that it had been robbed of $6.36 billion, the largest hack in history. North Korea is accused of orchestrating the theft.
About the same time, Reuters reported that the Pentagon is investigating a possible hack of refrigerators on six military bases. I am more worried about the freezers than the finance. That is a hack of the Internet of Things (IoT), an example of how vulnerabilities in mundane devices littered across our daily lives can become national security threats. Spoiled food a national emergency: You scoff? Let me explain.
Last month, some 700 supermarket chains and food retailers across France reported problems with their refrigeration systems. Temperatures were raised to defrost items; food was spoiled and in some cases equipment caught fire. Losses reached into the millions of euros. Authorities believe it was done remotely. A Dutch chain was hacked at the same time as the French companies but it is unclear if the cases are linked.
Those outages caught the eye of U.S. investigators, who noted that they resembled incidents at U.S. military commissaries in late August. Then, at least six stores reported similar problems within days of each other, with one doing the same defrost trick. The U.S. says it’s studying the cases with French authorities.
All appear to be IoT hacks in which attackers manipulate remote control systems that operate machinery. There are lots of refrigeration units in grocery stores: Display cases, cold rooms and freezers all have their own controller. In this case, the controllers — sold by Danfoss of Denmark and Dixell and its parent company Copeland in the U.S. — share critical vulnerabilities that made them susceptible to being hacked.
These are just a fraction of the exposed systems in this industry: One estimate found more than 2,750 Danfoss systems online, open to anyone with access to the internet. The company itself acknowledged that stores in Russia and Israel that used its equipment had been hacked a few years ago.
Fiddled freezers are not a national security threat. But think of refrigerators as the tip of the iceberg. Last year, there were an estimated 21.1 billion IoT devices worldwide. That number is expected to top 40 billion by 2030. In Japan, experts warn that the 80 million smart meters installed in homes are targets; add home power storage systems, air conditioners and electric vehicles and the number tops 10 million.
Many, if not most, are accidents waiting to happen. They are shipped with default settings — a password that is “password” — that are never changed or don’t get firmware updates.
Compounding the vulnerability is a lack of security in networks that transmit those instructions. Some 98% of IoT device traffic is unencrypted, which means almost all communications — updates, access and commands — are available to anyone who can stick a digital finger in the stream.
Hackers are hard at work. In 2025, it is estimated that there were on average 820,000 malicious IoT hacking attempts per day, up 46% from 2024. IoT malware attacks worldwide shot up 124% last year. One cybersecurity firm found an average of 32 vulnerabilities per router or switch. Experts believe that “virtually every internet-connected device is tested by attackers, often within minutes of going online”.
Earlier this year, law enforcement in the U.S., Germany and Canada disrupted four IoT botnets that had infected more than 3 million devices, such as routers, web cams, digital video recorders and smart TVs. In July 2025, more than 10 million smart TVs, digital projectors, in-car infotainment systems and digital picture frames were found to have been compromised, either with malware preinstalled before purchase or downloaded when the item first booted. They were used for all sorts of nefarious purposes: click fraud, account hijacking and DDoS attacks.
AI will make things worse. It democratizes hacking, allowing individuals to do what it previously took teams to do. AI speeds up the development and proliferation of hacks, making it harder to patch vulnerabilities in time. AI managers that control remote systems create another attack surface. Bad guys can hack the AI itself to gain access to all the systems it controls.
Or look at things from the other end of the telescope: Those billions of IoT devices can become nodes in an AI-directed bot. As Anthropic explained in a research report last month, small AI models may be able “to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes. A replicator like this would be challenging to shut down”.
The temptation is to look at these vulnerabilities as creating opportunities for theft or extortion, or to see the critical nodes as small, portable devices such as phones, tablets and laptops, or public-facing systems such as email and websites, with which we are all familiar. That is small ball. The real risk of IoT hacks is the disruption of entire industries when their digital infrastructure is corrupted and manipulated for nefarious purposes.
Iran is believed to have hacked U.S. water control systems in July, simultaneously hitting at least 12 states and as many as 100 targets. Automatic monitoring systems of gas stations were targeted earlier in the summer. One study charted a 459% increase in observed IoT-based attacks from mid-2024 to mid-2025 in the energy sector alone.
There are also more “traditional” intelligence uses. Russian hackers got access to traffic and residential cameras in Ukraine to monitor troop movements and air defenses. They tried to do the same in cameras throughout Europe to track aid, arms shipments and personnel movements. Iranian hackers reportedly did the same to cameras throughout the Middle East and Persian Gulf early this year.
Now contemplate “smart cities”, entire communities connected by digital infrastructure that is intended to be all encompassing, all seeing and all serving. This is the ambition of many governments — and the fever dream of hackers if their security levels replicate those that currently exist. Malware News reported a 410% increase in IoT attacks on construction related to smart city projects in 2025.
Governments are catching on. The U.S. Department of Defense announced in September the FORTRESS America (Federal Operations for Resilience, Troop Resources, Energy, Supply and Survivability) initiative, which will ensure that every major military installation in the continental U.S. can sustain essential operations, such as access to electricity, water, fuel and communications, independently for at least 90 days. It’s designed to ensure continuity during a major global conflict, but its logic addresses more “mundane” IoT hacks as well, like, say, freezers in commissaries.
“Power is combat now. Without electricity, you lose communications, water, logistics, assembly lines and just basic military command structures”, said Sean Parnell, who leads the initiative.
Business has been slower off the mark. Security remains a build-on, rather than build-in. Including those measures slows the race of products to the market and adds costs. In addition, notes Dan Goodin at Ars Technica, companies focus on protecting documents, not systems.
That approach reflects long-outdated thinking about cybersecurity that is frozen in time. It must change. If they don’t adjust, things will surely heat up.
Brad Glosserman, a senior adviser at Pacific Forum, is the author of Peak Japan. His latest book, written with David Lee, Tech-Gemony, on the geopolitics of high-tech, is out now from Hurst Publishers.
Click Here For The Original Source.
——————————————————–
