Estonian experts warn connected home devices can be cyberattack targets

Technology expert Glen Pilvre told ERR that a cyberattack on October 11 raised refrigerator temperatures in hundreds of French grocery stores to as high as 50 degrees Celsius and spoiled large quantities of food. He said the damage was huge, running into millions of euros, and that the case shows how weakly protected connections can be entered.

Pilvre said washing machines, vacuum cleaners and refrigerators are among devices linked to the internet, where software may not be updated and passwords can be easy to guess. He described an aquarium control system in a casino that was open to outside attacks. "There was one interesting case where the control system of an aquarium in a casino was similarly vulnerable to outside attacks. They gained access through it, and because it was on the internal network, they were able to get their hands on casino customers' data through the aquarium's control system," he told ERR.

The Information System Authority (RIA) is responsible for ensuring that these kinds of security vulnerabilities do not exist in Estonia. Compared with France, the agency believes the situation here is relatively good. Vital service providers must follow strict requirements and are constantly monitored.

RIA incident response department head Taavi Kupper said few devices are connected to the internet. Those affected have already been contacted and given instructions on how to hide or close off access points, or informed about countermeasures. The agency would not tell ERR which companies are involved. Major developments in the cyber sphere have also affected criminal activity, ERR reported.

University of Tartu professor of space and defence technology Mart Noorma told ERR that artificial intelligence plays a role and that, in the hands of malicious actors, it is possible to do more harm even faster. "In the same way, artificial intelligence helps defenders protect themselves better," he added.

Kupper said AI has made the entire attack process very fast and short. "In the past, after discovering a vulnerability, we could hope for a 30-day update cycle before something might be compromised," he said. A vulnerability is now exploited within two to 24 hours.

Experts say today's hackers look for ways to get rich quickly rather than setting out to attack household appliances. The Estonian Defence Forces told ERR that military infrastructure is subject to much stricter oversight and that an attack would be a waste of time, although malicious actors constantly test the systems.

Cyber Command chief René Innos said there are around 100,000 incidents a day on average. "We do not see this as a particular threat," he added. There are around 20–30 serious incidents a year, Innos said.