Hackers Target Retailers' Fridges, Binance, Ukraine in Wave of Attacks

Alex Pearce was doing his morning rounds at his London fruit and vegetable wholesale business when he noticed the defrost light on refrigeration unit 2 had switched on and the panel read 150C. Within minutes, as reported by The Guardian, he pulled the internet cable connecting his cold storage units to the network, suspecting a cyber-attack. He was right, and he was not alone: retailers across Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported refrigerators and freezers soaring to as high as 50C the same day.

What Happened

According to The Guardian, the fridge attacks struck commercial cold storage systems across seven European countries on the same Monday, including French blood banks, and came days after two other major incidents: a $6.3bn theft from the cryptocurrency exchange Binance on October 30, described as a record heist, and a hack of Ukraine's emergency alert app on November 1 that sent a fake nuclear strike warning to people in Kyiv. The timing and scale of the fridge incidents suggest coordinated action, though The Guardian reported that at least one expert, Xavier Bellekens, chief executive of the cybersecurity firm Lupovis, said his startup's "honeypot" traps on the same fridge controllers detected techniques previously linked to Russian-affiliated groups, while the Binance hack has been attributed to North Korea.

The Danish firm Danfoss, which supplies operating systems for the affected refrigeration units, told The Guardian that most of the compromised equipment was old and no longer receiving security updates, adding it had "long recommended" customers install updates or replace obsolete software. Pearce's own fridge monitoring system, installed in 2018 by the US firm Copeland, now needs updating, according to Pearce. The Guardian also reported that if the attack had occurred on a Saturday morning when Pearce was not present, it could have resulted in a fire. NCSC's Paul Chichester said the cold storage hackers 'really didn't need' AI to find the fridge flaws, since vulnerabilities such as default access passwords were already published in one fridge operating company's manuals.

NCSC chief Richard Horne told The Guardian the UK is in the "foothills" of a new hacking field, pointing to AI systems exposing long-standing IT vulnerabilities.NCSC also warned it was "highly likely" AI-powered malware would be used against UK power stations, airports and hospitals by 2028, with AI assisting attackers in scouting targets, locating weaknesses in IT networks, and writing malicious code.

The Guardian also reported that since Anthropic released its Mythos model in April, the number of software vulnerabilities discovered by leading tech companies has risen eight-fold, though attacks have not scaled at the same rate. Cybersecurity expert Tal Be'ery was cited suggesting criminal hackers are struggling to monetize the surge in discovered flaws, pointing to a decline in ransomware revenue. The Guardian reported that Finland, which shares a 1,340-kilometer border with Russia, recorded nearly 21,000 cyber-incidents last year, compared to about 13,000 in 2022. The trend extends across NATO countries but is especially pronounced in nations bordering Russia, The Guardian noted. Samuli Bergström, vice-president of Helsinki-based cybersecurity firm WithSecure, told The Guardian that attackers are "mostly opportunistic," and that any device connected to the internet should be assumed vulnerable to eventual attack.

Why It Matters

This week's incidents turn an argument about software patching into one about capital spending on energy and cold-chain infrastructure. Danfoss's admission that affected units were running end-of-life systems points to a familiar corporate calculation: retailers and wholesalers delay replacing refrigeration control systems because the equipment still cools food, even as its network-facing software goes unmaintained. That calculus now carries direct financial and safety exposure, as Pearce noted a weekend failure could have caused a fire. The vulnerability was not zero-day; it exploited published default credentials, suggesting that even basic IT hygiene failures create exploitable gaps when legacy systems remain internet-connected indefinitely.

The pattern extends beyond supermarkets. NCSC's warning that AI-assisted attacks are likely to target power stations by 2028 places energy infrastructure squarely in scope, and the same underinvestment logic that left fridge software unpatched for years could apply equally to grid equipment nearing end of life. As AI companies increasingly purchase reactor capacity to power data centers, the stakes around energy infrastructure resilience intensify - a power grid compromise could disrupt not only regional electricity supply but also the compute capacity underlying critical AI systems. Companies tracking commodity exposure now have reason to weigh cybersecurity resilience alongside supply and pricing risk when assessing exposure to industrial and grid-connected assets.

Background

The fridge attacks follow an established pattern of infrastructure targeting in the gray-zone conflict between NATO nations and state actors. The Guardian reported that Russia has conducted a sustained hybrid warfare campaign against Europe, and Finland - with its 1,340-kilometer border with Russia - has experienced a sharp uptick in cyber-incidents since the 2022 Ukraine invasion. This year, hackers compromised up to 50,000 Finnish government mobile phones; last year, they took down the website of Finland's ministry of defence. Ciaran Martin, founding chief executive of NCSC, told The Guardian this represents "one of those waves of incidents that happen every few years," comparing it to NotPetya and WannaCry in 2017 rather than characterizing it as significant.

What to Watch

Watch whether European regulators move beyond voluntary patching recommendations, like Danfoss's, toward mandatory end-of-life replacement rules for internet-connected industrial equipment, including refrigeration and grid hardware. NCSC's 2028 power station warning gives energy operators a concrete deadline to assess legacy control systems. Also watch whether Finland's cyber-incident trend, nearly 21,000 reported incidents last year against about 13,000 in 2022, spreads to other states bordering Russia, and whether Binance or Ukrainian authorities issue formal state attribution. The question of whether AI-discovered vulnerabilities will enable attackers to conduct more sophisticated campaigns by 2028 remains open; while the eight-fold rise in discovered flaws has not yet translated to an equivalent surge in successful breaches, the tools enabling attackers to exploit these gaps are still evolving.

Further reading and context

• Small Modular Reactors — How SMRs Could Power the AI Economy
• Nuclear Fusion — Economics, Timeline, and the Path to Commercial Power
• ITER — The International Fusion Reactor, Its Timeline, and What First Plasma Means