Alex Pearce, a London fruit-and-veg wholesaler, noticed his refrigeration units spiking to 150°C on a Monday morning and yanked the internet cable. He was right to panic. The same day, retailers across Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden reported similar attacks — commercial fridges and freezers soaring to 50°C. French blood banks were also hit. The attack exploited known vulnerabilities in internet-connected refrigeration controllers, many running end-of-life software with default passwords published in their own manuals. The fridge attacks were one of three major incidents in a single week. On 30 October, North Korean hackers stole $6.3bn from Binance, the world's largest cryptocurrency exchange, in a record heist. On 1 November, hackers targeted Ukraine's emergency alert app, sending a fake nuclear strike warning to Kyiv residents. Richard Horne, head of the UK's National Cyber Security Centre, said the country was in the "foothills" of a new hacking landscape, warning of "a huge rise in the volume of incidents." The structural accelerant is AI-powered vulnerability discovery. Since Anthropic released its Mythos model in April, the rate at which leading tech companies find IT vulnerabilities has increased eightfold. OpenAI's ChatGPT technology helped discover a flaw in PHP, a language underpinning much of the web, forcing precautionary takedowns of websites worldwide. Tech entrepreneur Azeem Azhar called this the internet's "Wuhan moment." Cloudflare executive Matthew Prince predicted "a couple of years where every single week it's going to feel like the sky is falling." The NCSC tempered the alarm slightly. Operations director Paul Chichester noted the fridge hackers "really didn't need" AI — the flaws were already sitting in plain sight, including published default passwords. Sophos reported no major client incidents from the PHP vulnerability, despite significant exploitation attempts. Cybersecurity expert Tal Be'ery observed that the surge in discovered vulnerabilities has not yet translated into a proportional surge in breaches, partly because criminal hackers are struggling to monetize the flaws, with ransomware revenues actually declining. Former NCSC chief Ciaran Martin pushed back harder on the catastrophist framing, pointing to NotPetya and WannaCry in 2017 and the 2021 ransomware wave as precedents. "It's a bad run, but it's not unprecedented," he said. "We are having one of those waves of incidents that happen every few years." The counterargument is that previous waves did not have an AI accelerant capable of discovering vulnerabilities faster than defenders can patch them — a structural asymmetry that may not revert to baseline. The geopolitical dimension is unmistakable. The fridge attacks showed Russian hallmarks according to Xavier Bellekens of Lupovis, whose honeypot traps lured attackers using ISPs associated with prior Russian operations. Finland, sharing a 1,340km border with Russia, recorded nearly 21,000 cyber incidents last year — up from 13,000 in 2022. Hackers compromised up to 50,000 Finnish government mobile phones this year alone. The NCSC warned that AI-powered malware would "highly likely" target UK power stations, airports, and hospitals by 2028. The deeper problem is architectural. Billions of internet-connected devices — fridges, routers, smart speakers — run software that will never be updated. Danish firm Danfoss acknowledged most affected equipment was old and no longer receiving security patches. The UK government launched its "Be Ready" campaign urging citizens to stockpile three days of food and water. Defence Secretary Wes Streeting warned of "state-sponsored terrorism" targeting everyday infrastructure. The attack surface is expanding while the patch cycle remains glacially slow, and AI has just handed attackers a faster map of every unlocked door.
