French fridge hack puts Estonia's exposed devices under scrutiny

News early this week that refrigerators in French grocery stores had been hacked, thawing cabinets and destroying large amounts of food, is a reminder that any device on a network can become a target. In an internet age, familiar cybercrime stories about websites and data leaks sit alongside attacks on ordinary equipment.

Hackers recently reached the refrigerators of hundreds of food shops in France, turned the heat up and destroyed tonnes of thawed food. Who carried out the attack, and why, is still unknown. The case also raises a wider question about the security of vital services.

Technology expert Glen Pilvre said the damage was very large and ran into the millions of euros, explaining that chickens and carrots all thawed. He said the incident shows that everything is connected by wire, and that if the locks on those connections are slightly ajar, someone can slip through.

Reaching the refrigerators required no particular sophistication: the devices were old and the software was out of date. Simple security gaps can leave all kinds of everyday equipment exposed. Pilvre said washing machines, vacuum cleaners and refrigerators are all, in their own way, on the internet, that updates to their software may not be prompt at all, and that factory passwords, for example on routers, can be quite trivial.

He described another case in which a casino aquarium control system was similarly exposed to the outside. Attackers entered through it and, because it sat on the internal network, reached casino customers' data via that control system.

The Estonian Information System Authority (RIA) is responsible for seeing that such gaps are not found in Estonia. The agency says the situation here is relatively good compared with France. Providers of vital services face strict requirements, and oversight is continuous.

Taavi Kupper, head of RIA's incident-handling department, said Estonia has only a handful of devices visible on the network and that all the parties involved have already been contacted. Guidance has also been passed on about how to hide that endpoint, close it, or which countermeasures to take. The agency is not saying which companies are involved. Recent changes in the cyber field are also shaping crime.

Mart Noorma, professor of space and defence technology at the University of Tartu, said artificial intelligence now lets people with harmful intent do more damage, faster, as a tool. He added that the same capability helps defenders protect themselves better, and that in future AI might also, for one reason or another, begin destroying systems on its own.

Kupper said AI has made the entire attack path very fast and short. He said that after a vulnerability was found, defenders could once hope for a 30-day update cycle before something might be compromised. A vulnerability is now compromised within two to 24 hours.

Experts say today's hacker does not dream of attacking home appliances and is more often looking for a quick way to get rich. Asked whether a small security hole could strike the security of the whole state, the Defence Forces say military infrastructure is under significantly stricter supervision and that an attack would be a waste of time. Troublemakers still test those systems constantly.

Cyber Command chief René Innos said such cases average 100,000 a day, and that he does not see a particular danger in them. He said the cases that raise his blood pressure number about 20 to 30 a year on average.

Estonia gained experience of a large-scale cyberattack during the Bronze Night of 2007, when state institutions, banks and media outlets were targeted. It was the first attack of that scale against a single country in world history. That experience has helped Estonia remain one of the more cyber-defended countries to this day. The French case shows that a single careless mistake can still be enough.