From the refrigerator to tap water or electricity: cyberattacks are already impacting everyday life

Raising the temperature of refrigerators in supermarkets in 12 countries to spoil tons of food. Leave the websites of half the world hanging. Execute the biggest robbery in history. Access personal data of the South Korean Prime Minister and his cabinet. And to the medical history and financial information of almost half a million Moldovans. This is the summary of what the most relevant cyberattacks have achieved in the last two weeks alone. If we extend the focus until summer we can add to the list problems in the distribution of water in 12 US states or the hacking of the Australian health system. Analysts fear that this is the new normal: a scenario in which everything, including the physical world, can be shaken by keyboard strokes and mouse movements.

We are experiencing a change of era. Cyberattacks have skyrocketed in recent times, both in quantity and quality. The number of incidents recorded increases year after year with double-digit figures (in Spain, 24%, according to data from the National Cybersecurity Institute). And, as the refrigerator episode demonstrates, the power of hackers goes beyond stealing data or extorting companies: they are also capable of intervening in the operation of critical infrastructures.

Artificial intelligence (AI) is responsible for the new scenario we are entering. The legendary hacker Charlie Miller - a former employee of the United States National Intelligence Agency (NSA) and known, among other things, for being the first to hack iPhones or for managing to control the braking, acceleration and steering system of a Jeep Grand Cherokee in 2014 - is clear that this technology has placed us on another screen. “Can we please stop talking about how rogue AI will kill us and go back to focusing on all the cool vulnerabilities it's finding?” he said on the social network X just two months ago.

AI changes everything

That is the key: AI has accelerated times, and that is equivalent to changing the game board of cybersecurity. This technology is a formidable ally for those who try to prevent cyberattacks, but also for those who design and execute them. “AI can help identify zero day flaws [zero day, those that have not yet been discovered by anyone] and develop exploits [the program that takes advantage of a flaw or vulnerability], all quickly,” says Lukasz Olejnik, cybersecurity consultant and researcher in the Department of War Studies at King's College London.

Computer programs are written with thousands of lines of code that contain instructions that the computer interprets and executes to perform different tasks. Operating systems, for example, can have millions of lines. The more complex a software is, the more likely it is that there will be some error in that text. This failure is what the sector calls a vulnerability. The reason for software updates is to patch bugs that are found, so that they cannot be exploited by cybercriminals.

AI has broken the balance of this process. “We have entered an era where discovering and exploiting vulnerabilities is much faster than fixing them,” says Olejnik. According to data collected by the Andreessen Horowitz fund, the average time that passes between a vulnerability being disclosed and an attack being launched to exploit it was 63 days in 2018. In 2025, an attack is carried out a week before the flaw or bug is disclosed.

"AI can help attackers investigate targets, compose convincing messages, generate code and detect vulnerabilities in software. It can make some phases of an operation faster and cheaper, allowing the same actor to attempt more attacks. It is a very significant change, even if many of the attack techniques are already known," says cybersecurity expert Mikko Hyppönen.

It is also to be hoped that this progression does not stop. "What worries me most is that the entire process is automated. The fact that one program looks for weaknesses in another program changes the economics of the attacks. As the cost decreases, there are more and more targets that are worth pursuing," warns Hyppönen.

From digital to physical

The acceleration and democratization of cyberattacks is only part of the picture. The illustration is completed with another element: the barrier that separates the digital world from the physical world is diluted. You can recover a database if you have saved a backup, but you cannot recover spoiled food. “We live in a cyber-physical system, in which physical devices are controlled or operated remotely by information technologies,” emphasizes Vladimir Dashchenko, senior researcher at Kaspersky's critical and industrial infrastructure division.

Going back to last week, a cyberattack raised the temperature of supermarket refrigerators and freezers in a dozen European countries, spoiling tons of food. The attack, identical to another carried out three weeks earlier, was also launched on the refrigerators of the organization that manages blood donations in France, although in this case it was stopped.

It is not the first time that a cyberattack impacts the real world. In 2007, almost 20 years ago, the then vice president of the United States, Dick Cheney, ordered that the WiFi function of his pacemaker be deactivated. A year later, researchers from the University of Massachusetts managed to hack one of those devices to stop the pumping system at will. It was a first warning.

There were more. In 2010, the US and Israeli secret services managed to introduce pen drives into the Iranian nuclear power plants of Bushehr and Natanz. In this way, Stuxnet, a computer worm (a virus that replicates to infect other computers), was downloaded into its systems, physically damaging many uranium centrifuges.

In 2014, a cyberattack caused system failures at a steel mill in Germany that prevented a controlled shutdown of a blast furnace, causing “massive damage,” according to the BSI, the country's national cybersecurity agency. In 2015 and 2016, with the annexation of Crimea still recent, Russia launched one of the most sophisticated attacks on energy infrastructure in memory. "BlackEnergy and Industroyer managed to sneak into the control systems of Ukrainian electrical substations. The attackers did not need to destroy equipment, since they used the infrastructure's own operating functions to interrupt the service and leave tens of thousands of people without electricity in the middle of winter," explains Josep Albors, head of research at ESET Spain.

The ransomware (system hijacking) that the Colonial company suffered in 2021 was also very popular, which caused them to preventively stop the activity of one of the largest oil pipelines in the United States, causing shortages in the country. The attack is attributed to the North Korean group Lazarus, which last week carried out the largest cyber coup in history, stealing $6.3 billion in cryptocurrencies from the Binance portal. This summer, hackers linked to Iran attacked 30 water facilities in 12 states, causing water supply failures in some cities.

The refrigerator incident is not an isolated event. These things already happened. But now more happen. “Although cyber attacks against critical infrastructure have been occurring for a long time, their number has increased significantly,” says Albors.

The new normal

There are extremely complex attacks, requiring months of preparation, planning and code development. This is the case of the first blows to infrastructure, such as Stuxnet, which managed to delay the Iranian nuclear program for a few years, or BlackEnergy, which left thousands of Ukrainians without heat in the middle of winter.

The one with refrigerators is simpler. The first investigations point to the use of weak or default passwords and the lack of updating equipment. It is a sign of the new times. “The attack does not seem very sophisticated, and that should worry us even more: you do not need to be a powerful actor to cause significant physical problems,” reflects Eusebio Nieva, technical director of Check Point Software for Spain and Portugal. “Today we talk about supermarket refrigerators, but tomorrow it could be healthcare facilities, industry, logistics or transportation,” he adds.

There are more and more connected devices, so the attack surface continues to grow. "You no longer need to break into a supermarket to destroy the food there. What happened this week is practical confirmation of the 'Hypponen Law': if you're connected, you're vulnerable," says Hypponen. The motivation of the attackers is also unclear. "Some want money. Others want espionage. There are those who seek to sow chaos. In recent weeks we have seen all three, and the borders overlap," reasons this Finnish computer scientist. Geopolitics? Opportunism? Profit motive? Probably a little of each.