On the night of 11 October 2026, someone turned off the cold in up to 700 French supermarkets. Not by cutting power, but by logging into the refrigeration controllers and setting them to defrost with the stock still inside. By morning, cabinets that should have been sitting near 4°C had climbed towards 50°C. One store in Normandy recorded 80°C. In some shops the heat melted equipment and set off fire sprinklers, which then caused water damage on top of the spoiled food. The bill is estimated at more than €10 million.
Three weeks later, on 2 November, it happened again. Supermarkets in Belgium, Luxembourg, Estonia, the Netherlands, Ireland and Sweden reported refrigeration problems overnight. No group has claimed either operation. French authorities believe international actors were involved in the October attack, but nobody has been officially blamed.
It would be easy to file this under “supermarket problem” and move on. That would be a mistake. The fridge attacks are the clearest demonstration yet of a pattern that applies directly to British homes: a device gets connected for convenience, nobody patches it, it keeps a factory login, and one day it becomes someone else’s tool. The scale is different in your kitchen. The mechanics are almost identical.
What actually went wrong in Europe
The French investigation points to refrigeration controllers made by Danfoss, plus Copeland and Dixell XWEB units. These are industrial bits of kit, not domestic fridges. They were designed to be monitored remotely, so each one ran a small web server reachable from the public internet.
According to reporting by Reuters, AP, The Guardian and Euronews, many of those controllers could be accessed with the username “admin” and a password based on the current date. The flaw was not unknown. Security firm Claroty had documented it in 2025, Danfoss published an advisory in March 2025 and released a fix in August 2025. Two of the affected controller families, the AK-SC355 and the AK-SM800, had reached end of life in 2016 and 2021. Units that were never updated, or never replaced, stayed exactly as they were: online, unpatched and easy to find.
That is the whole story. No sophisticated zero-day, no nation-state magic. A known vulnerability, a default credential and a device that should have been retired years ago.
Why your home network has the same shape
A domestic fridge is not usually exposed like a supermarket controller. Most smart appliances talk to a vendor cloud through an app, and the fridge itself sits behind your router. The risk is real, but it is one step removed.
Your router is not one step removed. It is the front door.
The 2026 IoT Security Landscape Report, published by Bitdefender and NETGEAR on 28 October 2026, looked at telemetry from roughly 10.4 million smart homes between January and September. It analysed 5.4 billion security events and 1.2 billion vulnerability observations. The headline numbers are uncomfortable:
- The average connected home now has 24 internet-capable devices, up from 22 a year earlier.
- Reconnaissance made up 90.1% of detected attack activity. Most of what hits a home network is automated scanning, looking for weak spots to use later.
- Smart TVs, smart plugs and network-attached storage accounted for 67.1% of vulnerability observations. These are devices people buy once and rarely replace.
- 99.97% of the observed vulnerabilities were publicly known CVEs. Almost nothing hitting homes is exotic. It is old and unpatched.
Cloudflare’s Q3 2026 DDoS report adds the wider picture. The company mitigated 18.2 million network-layer DDoS attacks in the quarter, about 8,226 every hour. Law enforcement dismantled four of the largest IoT botnets, Aisuru, KimWolf, JackSkid and Mossad, earlier in the year, and hyper-volumetric attacks above 1 Tbps fell by nearly 69% as a result. New variants such as Dysphoria are already filling the gap. The botnets do not disappear. They rebuild from the same pool of badly secured devices.
The attacks that actually reach a UK home
Most home incidents do not look like a film. They look like one of these:
Router admin takeover. Someone reaches your router’s login page, either from the local network or through a remote management feature, and gets in with a default or reused password. From there they can change DNS settings, open ports, or push firmware.
DNS hijacking. The router hands out a different DNS server. You type the right address, land on a convincing copy, and enter a password. Nothing on your devices looks broken.
Botnet recruitment. An always-on device with a known flaw gets scanned, infected and added to a pool. You notice a slower connection, or nothing at all. Your broadband line is now sending junk traffic at someone else’s target.
Evil twin and downgrade attacks. A fake access point with the same name as your network persuades a device to connect. The WPA3 transition mode most homes run can be forced back to WPA2, which makes the handshake capturable for offline cracking.
Weak WPS and UPnP. WPS PINs and automatic port mapping are conveniences that remove most of the work from an attacker. Both are still switched on by default on plenty of ISP routers.
What the UK already requires
Since 29 April 2024, the Product Security and Telecommunications Infrastructure Act has made three things mandatory for consumer connectable products sold in the UK: no easily guessable universal default passwords, a published route for reporting vulnerabilities, and transparency about how long security updates will be provided. The rules apply to anyone marketing a device under their own name, which includes BT, Sky, Virgin Media, TalkTalk and the other ISPs that badge routers. Enforcement can reach £10 million or 4% of worldwide turnover, whichever is higher.
That does not mean every router in the country is now safe. It means the baseline has moved, and the devices that predate the law are the ones to worry about. NCSC’s Annual Review 2026, published on 3 November, says its Share and Defend service now protects more than 61 million mobile subscribers and 12 million fixed broadband lines, and has blocked over a billion early-stage attacks and attempts to reach scam sites.
Seven checks worth doing this weekend
You do not need to become a network engineer. You need to close the doors that are usually left open.
1. Change the router admin password, not just the WiFi password. These are different logins. The WiFi password gets guests online. The admin password controls the router itself. Use a long, unique passphrase and store it in a password manager.
2. Turn off remote administration. Look for “remote management”, “remote access”, “cloud management” or “web access from WAN” in the router settings. If you do not actively use it, disable it.
3. Move to WPA3, and switch off WPS. Choose WPA3 if every device supports it. If one older device does not, use WPA2 with AES, never TKIP or mixed WEP. WPS should be off even if it is convenient, because the PIN is brute-forceable.
4. Put the smart devices on their own network. Most ISP routers now offer a guest network. Give it a different name and password, enable client isolation, and move TVs, plugs, cameras, robot vacuums and the fridge onto it. Your laptops and phones stay on the main network. If the guest network is compromised, the important stuff is still separated.
5. Patch the router, then replace it. Check the firmware version and turn on automatic updates if the router offers them. If the model stopped receiving updates, ask the ISP for a newer one. A router that is five years old and out of support is the home equivalent of an end-of-life Danfoss controller.
6. Turn off UPnP unless something needs it. Universal Plug and Play lets apps open ports without asking you. It is convenient for games consoles and some video calls, and it is also a way for malware to punch a hole through your firewall. Disable it and open specific ports only when required.
7. Lock down DNS. Set the router to a filtering resolver such as Cloudflare’s 1.1.1.2 or Quad9, and change the router admin password so nobody can point it elsewhere. This blocks a large amount of malware and phishing before it reaches your devices.
One more habit is worth adding: once a month, open the router’s device list and look for hardware you do not recognise. An unknown device on the network is not always an intruder, but it is always worth identifying.
What this means for the fridge in your kitchen
A connected fridge is a computer with a compressor. It should be treated like one.
Check whether the manufacturer still supports the model and for how long. Register the appliance so you get security notices. Use a unique password for the vendor app, and turn on two-factor authentication if it is offered. Keep the fridge on the guest network, not the same one as your laptop and phone. If the app has not been updated in years and the vendor has stopped publishing firmware, that is a sign the product has been abandoned, not that it is safe because it is “just a fridge”.
The same advice applies to smart plugs, cameras, doorbells, thermostats and robot vacuums. They are the devices attackers scan for because they are cheap, always on and rarely touched after setup.
If you think your network has been used
Start with a factory reset of the router, then install the latest firmware before you reconnect anything. Change the WiFi name and password, and the admin password. Check the DNS settings, the port forwarding rules and the list of connected devices. If your ISP provides the router, ask them to confirm the current firmware and replace the unit if it is out of support. Then change the passwords on the accounts that matter, starting with email and banking.
A slow connection is not proof of infection, and a fast one is not proof of safety. The scanners are quiet by design.
The lesson from Europe’s freezers
The fridge attacks were not a warning about refrigeration. They were a warning about what happens when convenience outruns maintenance. A controller installed in 2014, connected to the internet for remote monitoring, and never updated is not a rare edge case. It is the default outcome when nobody owns the problem.
Your home network is smaller, but it has more devices than ever, and most of them were installed by someone who has long since thrown away the manual. The good news is that the fixes are boring, free and take an afternoon. Change the admin password. Turn off what you do not use. Separate the smart stuff. Patch the router. Replace what is out of support.
Boring is what keeps the freezer cold.
This article is part of a joint series with SmartphoneSoutions.eu, our sister site for phones, routers and connected home hardware. Their team tests the kit; we explain what it means for your home.
FAQ
Can a hacker really get into my fridge?
A domestic fridge is rarely exposed directly to the internet. The realistic route is through the vendor’s app or cloud account, or through your router if it has been compromised. Treat the fridge as one more connected device and keep it on a separate network.
Is WPA3 enough on its own?
WPA3 is a real improvement, but most homes run it in transition mode so older devices can still connect. That mode can be downgraded to WPA2 by an attacker nearby. Use WPA3 where possible, and rely on a strong passphrase plus a separate network for smart devices.
How often should I replace my router?
When the manufacturer stops issuing firmware updates, or roughly every three to five years if your ISP will not confirm a support window. An out-of-support router is the biggest single risk on most home networks.
Do I need a VPN at home?
Not for ordinary browsing. A VPN protects traffic on untrusted networks, such as hotel or cafe WiFi. At home, router hardening and DNS filtering do more for less effort.
Does the PSTI Act protect me if I bought my router before 2024?
No. The law applies to products placed on the market from 29 April 2024. Older equipment is not retroactively covered, which is exactly why out-of-date routers should be replaced.