The Fridge Got Hacked. Welcome to the Internet of Everything.

If you connect it, they can hack it. Yes, apparently that includes the refrigerator.

Somewhere along the way, refrigerators stopped being insulated boxes that kept the milk cold and became computers with compressors attached.

Convenient? Absolutely. Also another reminder that once we put software, connectivity, remote access and credentials into everyday objects, they become part of the cyber risk landscape.

That lesson became considerably less theoretical this month.

Ars Technica reported that Internet-connected refrigeration controllers were compromised across an estimated 700 supermarkets in France, with incidents also reported elsewhere in Europe. Attackers were able to remotely activate defrost functions, reportedly sending temperatures as high as 50°C (122°F). Food spoiled. Electrical systems caught fire. The financial damage may run into tens or even hundreds of millions of euros.

Read the original Ars Technica reporting

The remarkable thing is that this does not appear to have required some dazzling new form of cyber wizardry.

The controllers reportedly included older or end-of-life systems, known vulnerabilities and weak credential mechanisms. Researchers also pointed to devices exposed directly to the Internet instead of being protected through measures such as VPNs and IP allowlists. Updates, stronger access controls and basic cyber hygiene could have dramatically changed the outcome.

Which brings us to one of the oldest Cybermaniacs rules:

If you connect it, they can hack it.

Funny when we put it on a mug. Less funny when the fridge catches fire.

Why are connected devices a cybersecurity risk?

An Internet of Things, or IoT, device is really just a physical object that has acquired computing capability and network access. That can mean an industrial controller running refrigeration equipment across hundreds of stores, but it also includes the much more ordinary technology sitting around our homes: thermostats, televisions, doorbells, security cameras, speakers, printers, baby monitors, exercise equipment, lighting systems and increasingly the appliances in the kitchen.

The distinction matters because people still tend to think of many of these things primarily by what they do rather than by how they work. A thermostat feels like a thermostat. A camera feels like a camera. A fridge still feels like a fridge.

From a security perspective, though, the important question is whether the thing contains software, talks to a network, accepts commands, stores information, receives updates or relies on credentials. Once it does, it has an attack surface.

That does not mean every connected device is inherently dangerous, or that the answer is to unplug the house and return to churning butter. It means we need a more realistic mental model of the technology around us. When everyday objects become connected computers, they inherit many of the same security problems as other computers — except we often pay far less attention to them.

Why does smart-home cybersecurity matter?

Cybersecurity awareness has traditionally been framed around the workplace. Employees learn how to recognize phishing, protect corporate accounts and handle business information, then go home to a completely different digital environment that may include dozens of connected devices, personal cloud accounts, shared family technology and a home network carrying both personal and professional activity.

That boundary makes less sense every year.

Remote and hybrid work have made the home part of the practical technology environment of the organization, but even that is only part of the story. People themselves are the bridge between those environments. They use the same judgment, habits and mental models whether they are responding to a message on a work laptop, setting up a new smart camera, helping a parent recover an account or deciding whether an authentication request looks legitimate.

We explored this more deeply in Home as an Attack Vector, because attackers do not particularly care whether the opportunity they find has been categorized as “personal” or “professional.” They care whether it gives them access, leverage or useful information.

Read: Home as an Attack Vector — How Hackers Target Families to Compromise Companies

The modern digital perimeter increasingly follows the person rather than the office.

That is why personal cybersecurity belongs in the awareness conversation. Not because employers should be monitoring or managing people's homes, but because helping people become more capable digital citizens creates benefits wherever those people happen to be operating.

How can people protect smart devices at home?

The good news is that most people do not need specialist IoT expertise to reduce their risk. Much of the protection comes from the same basic cyber hygiene we already know works elsewhere, applied consistently to devices that are too often treated as appliances rather than computers.

Start by knowing what is connected to your network and whether it is still supported by the manufacturer. Default passwords should be changed, unique credentials should be used where possible, and software and firmware updates should not be ignored simply because the device happens to live on a wall or in the kitchen. Remote access should be enabled because it is useful, not simply because it exists.

The home router deserves particular attention because it sits in front of everything else. Keeping its software current, protecting its administrative account and separating lower-trust smart devices from computers holding more sensitive information can reduce the consequences if one connected product turns out to be insecure.

Five steps to a safer smart fridge — and almost any other connected device

You do not need a security operations center for your kitchen. A few basic habits dramatically reduce the risk that a smart appliance becomes the weakest device on your network.

The important point is that these are not really “fridge security” practices. They are connected-device hygiene. The same logic applies to smart cameras, thermostats, televisions, speakers, doorbells, printers, exercise equipment and the growing collection of devices quietly joining home networks.

A useful rule of thumb is simple:

If it connects to the Internet, treat it like a computer — even if it also keeps the milk cold.

None of this is particularly glamorous, which is precisely why it tends to be neglected. Cyber incidents are often described in terms of sophisticated attackers and advanced techniques, but many real-world compromises still depend on mundane weaknesses: unsupported software, exposed systems, reused credentials and security settings nobody revisited after installation.

The supermarket incident is a particularly vivid example because those ordinary weaknesses translated into very physical consequences. Investigators highlighted patching, credential management, network restrictions and stronger control of third-party equipment among the measures that could have reduced the risk.

Cyber hygiene sounds boring right up until your frozen peas are on fire.

Should cybersecurity awareness teach personal digital safety?

We think it should.

For years, security awareness has been treated primarily as an enterprise compliance function. The organization has obligations, the employee receives training, a completion record is generated, and everyone can demonstrate that the annual requirement was met.

Compliance matters. People absolutely need to understand their responsibilities at work. But if that is the limit of the ambition, organizations are leaving a great deal of value on the table.

At Cybermaniacs, our mission has always been to create happier, cyber-secure humans. That means helping people understand cybersecurity well enough to use it in their actual lives, not merely recall the correct answer to a workplace quiz.

Someone who understands why password reuse is dangerous can apply that knowledge to a corporate account, a banking login and a streaming service. Someone who learns how social engineering works can use that judgment when an unusual request appears in Teams, when a parent receives a suspicious phone call or when their teenager gets a convincing message about a gaming account. Someone who understands the basics of authentication, software updates and connected-device security starts making better decisions across the whole digital environment.

That is where awareness starts to become capability.

It also changes the relationship people have with cybersecurity. Security stops being a collection of rules imposed by the employer and becomes something useful: knowledge that helps protect their money, privacy, family, identity and increasingly the technology operating around their home.

That is a far stronger foundation for behavior than compliance alone.

Explore how Cybermaniacs approaches human risk and behavior-led learning

What does personal cybersecurity have to do with human risk management?

Human Risk Management is sometimes interpreted too narrowly as identifying risky employees and assigning more training to them. That misses the broader problem.

Human risk exists wherever people interact with technology, information, processes and decisions. Those interactions do not start at the office door or stop when someone logs out of a corporate system. The same person moves between workplace systems, personal devices, family accounts, connected homes and public digital services throughout the day.

The practical value of personal cybersecurity education is that good mental models travel.

If someone understands why an unexpected MFA request matters, that knowledge works across accounts. If they understand how attackers manufacture urgency, authority and trust, that insight helps them recognize manipulation in more than one channel. If they understand that the inexpensive smart camera they just connected to Wi-Fi is actually a networked computer with software, credentials and potentially remote access, they are more likely to make sensible decisions about how it should be configured.

We have written before about why identity has become one of the central stories of modern cybersecurity as passwords gradually give way to stronger forms of authentication.

Read: The Death of Passwords — And Why Identity Is the Real Story

IoT security, identity security, phishing resistance and personal cyber hygiene are not isolated topics. They are parts of the same digital literacy people increasingly need to function safely in a connected world.

Cyber awareness should make life safer, not just work more compliant

The supermarket fridge hack is memorable because it sounds faintly ridiculous. Then you look at what actually happened.

Connected equipment was compromised. Refrigeration systems behaved in ways their operators did not intend. Food was destroyed, stores were disrupted, equipment was damaged and fires were reportedly triggered. A weakness that began in software crossed quickly into operational, financial and physical risk.

That is a useful reminder of how cybersecurity now works.

It protects far more than corporate data. It protects access to our money and identities, the privacy of our families, the systems we depend on at work and the increasingly connected technology operating in our homes. (And, apparently, our ice cream.) 

That should raise the ambition for cybersecurity awareness, and rightly so. The goal should not simply be to demonstrate that an organization told employees the rules. It should be to help people develop enough understanding, judgment and confidence to make better security decisions wherever technology appears in their lives.

At their desks. On their phones. At home. With their families. And around every increasingly clever little computer we keep buying and plugging into things.

Because the Internet of Things is ultimately still the Internet.

And you know the rule.

If you connect it, they can hack it.

So connect thoughtfully, protect the things that matter and make more happy, cyber-secure humans along the way.