Hot Fridges and a $6.3 Billion Heist: AI Speeds Up the Hunt for Security Holes

On Monday, London wholesaler Alex Pearce was walking through his warehouse when he noticed something odd: the defrost lights were on across the refrigeration units, and the panel read 150°C. He walked over to the box connecting the units to the internet and pulled the cable. It turned out to be the right call. That same day, stores in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported fridges and freezers heating up to 50°C. French blood banks were also affected.

Three Attacks in a Few Days

The fridges were only one episode. On October 30, $6.3 billion was stolen from the Binance exchange, a record hack. It is attributed to North Korean hackers. On November 1, a Ukrainian emergency alert app was hacked, and Kyiv residents received a false alarm about a nuclear strike. Richard Horne, head of the UK's National Cyber Security Centre (NCSC), said we are "in the foothills" of a new threat landscape. In his words, the main short-term risk is a huge rise in the number of incidents.

He points to AI. Since April, when Anthropic released the Mythos model, which can find vulnerabilities, the number of holes found by major tech companies has grown eightfold. Last month, AI from OpenAI helped find a bug in PHP, and some websites were temporarily taken offline as a precaution. Entrepreneur Azeem Azhar called it a "Wuhan moment." Cloudflare chief Matthew Prince predicted a couple of years when "every week it will feel like the sky is falling."

What AI Actually Has to Do With It

Nothing, at least in the case of the fridges. NCSC operations director Paul Chichester said bluntly that the hackers "didn't need" AI at all. The default access passwords had been published in one manufacturer's manuals. The scheme is simple: they attack companies that supply software for commercial refrigerators. The systems are connected to the network, which means remote access to the end victims. Danfoss, one of the affected vendors, said most of the equipment is old and no longer receives security updates. Pearce's own Copeland system has been in place since 2018.

Xavier Bellekens of Lupovis, who works with honeypot traps, saw a Russian signature: the hackers used providers tolerant of malicious activity. But there is no certainty, and the ties between hacking groups and states are often weak.

Not Panic, but Hygiene

There are sober voices too. NCSC founder Ciaran Martin considers the "Wuhan moment" an exaggeration: there were NotPetya and WannaCry in 2017 and a surge of ransomware in 2021. Analyst Tal Be'ery notes that the rise in vulnerabilities has not yet turned into a rise in breaches, and ransomware revenue is even declining. Sophos saw many attempts to exploit the PHP hole but recorded no serious incidents among its clients.

Also, a cyberattack is not the same as a bombing: software is patched faster than transformers are replaced, and a device can be disconnected from the network. Some attacks may be aimed at psychological effect: a hot fridge is memorable.

What Practitioners Should Do

The conclusion is boring and useful. First, build an inventory of everything that faces the internet, including industrial controllers and monitoring. Second, change default passwords and close direct access from the network. Third, plan to replace devices that are out of support: a product's "end of life" is an open door. If you make hardware or an IoT product, build the update period and support cost into your business model. Finnish expert Samuli Bergstrom puts it this way: if a device is connected to the internet, assume it will be attacked sooner or later.

Caveat: the article relies on statements from officials and vendors, and attribution of the attacks remains an assumption. Whether AI speeds up real-world hacks is still unclear. What is known is something else: Pearce pulled the cable in time, and many updates went uninstalled for years.