From the 1988 worm to the fridges: a history of cyberattacks

A November night, 1988

On 2 November 1988, at half past eight in the evening, a Cornell University student, Robert Tappan Morris, lets go of a program that copies itself from one machine to the next.^[1] He didn't mean to destroy anything, it seems. A mistake in how the program decided whether a machine was already infected made it multiply until it jammed the very computers it was only supposed to pass through. The usual figure is about six thousand UNIX machines, but that number is a rough guess: a tenth of a network of perhaps sixty thousand computers, and people still argue about how many were really hit.

I like starting there. It's the first big network incident, and it already has a flaw, a copy that spreads, and someone who notices after the damage is done.

When the network becomes a battlefield

On 27 April 2007, Estonia finds the websites of its parliament, ministries, banks and newspapers unreachable. The spark was the relocation of a Soviet monument in Tallinn, the Bronze Soldier; the method was mostly DDoS attacks, millions of pointless requests that choke a site.^[2] Some have called it the first web war. One of the most connected countries in Europe, with banks and ministries down for days on end, and not a single shot fired.

Three years later, on 17 June 2010, a Belarusian researcher, Sergey Ulasen, finds a strange program on Iranian machines. It will be called Stuxnet. It went looking for the centrifuges at the Natanz nuclear plant and spun them until they broke.^[3] No state has ever admitted writing it, though many outlets point to the United States and Israel. For the first time on record, a program was breaking a physical object.

On 23 December 2015 it's the turn of Ukraine's power grid. Phishing, control of the command systems, substations switched off remotely: about 230,000 people without electricity, for one to six hours. And while the lights went out, an attack on the call centre kept customers from asking for information.^[4] I remember it as a detail both cruel and calculated.

Household objects become an army

It starts in the living room. Between 23 December 2013 and 6 January 2014, the company Proofpoint observed a spam campaign: over 750,000 emails, sent from more than 100,000 devices; about a quarter of the emails came from equipment that wasn't computers: TVs, routers, media centres and at least one refrigerator.^[5] The fridge that sends spam became a joke, which is a pity, because it was a warning. It sent only a few at a time, no more than ten per IP address, precisely so it wouldn't get blocked.

On 21 October 2016 the warning becomes an attack. A program called Mirai, found in August, goes around trying some sixty factory-default usernames and passwords on cameras and routers connected to the internet; the infected devices attack Dyn, a DNS provider, and for hours GitHub, Twitter, Reddit, Netflix and Airbnb are unreachable.^[6] All it took was someone at home who had never changed “admin”.

Hospitals, petrol, power plants

On 12 May 2017 WannaCry sweeps across about 150 countries, with estimates of between 200,000 and over 300,000 computers hit. In English and Scottish hospitals, diagnostic equipment and blood-storage refrigerators were affected too; at least 81 of the 236 trusts of England's health service were involved, and some ambulances were diverted.^[7] It was stopped, in part, by a researcher, Marcus Hutchins, who registered a domain name hidden in the code and acted as a switch. It was also a stroke of luck.

In May 2021, Colonial Pipeline, the pipeline that supplies a good part of the US East Coast, shuts everything down as a precaution after a ransomware attack. Five days of downtime, dry pumps, an emergency declared in 17 states. The company paid about 75 bitcoin, around 4.4 million dollars, and then restarted mostly from its own backups, because the decryption tool was painfully slow.^[8] On 29 December 2025, in Poland, renewable energy plants and a combined heat and power plant were hit, and the attack reached the machines as well as the computers, which is unusual. CERT Polska and others point to different groups: attribution is still disputed.^[9]

The fridges of these days

Here is where we are. On the night between 11 and 12 October 2026, hundreds of French supermarkets, among them Intermarché, Netto, Carrefour, Monoprix and others, saw their refrigeration systems pushed into defrost mode. In some cases the temperature reached 50 degrees or more, and one store in Normandy reported 80. Whole aisles of food thrown out; some equipment melted, and at some stores the sprinkler systems did damage too. Losses are estimated at tens of millions of euros.^[10]

Then on 2 November it happened again, in other countries: Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland, Portugal, according to Wikipedia's account; the Italian reports in the notes count fewer, and the number of stores hit also changes from one source to another. In Ireland 13 SuperValu stores were hit, in Belgium at least 15 Carrefour. Cases have also been reported in Italy, in Tuscany and Sicily.^[11]

A clarification that gets lost in the headlines: the fridges involved are not the ones in your home. They are industrial controllers that run supermarket cold rooms, in particular Danfoss models (and some from Copeland and Dixell) with a login page reachable from the internet. Many accepted “admin” as the username and a “password of the day” calculated from the date: a flaw reported in 2025 by researchers at Claroty, for which Danfoss had released a fix in August of that year. Anyone who didn't install it was left exposed. Some models, besides, have been out of production for years and no longer receive anything.^[10]

Who is behind it? Nobody knows, or at least nobody has said. No one has claimed it, and in Belgium the federal prosecutor has opened an investigation. Ken Munro, of Pen Test Partners, doesn't rule out kids messing around, and notes that there are also states with the capability to do it: capability, not accusations. The reconstructions change by the hour, which is why I put the date just below.

What's left, at home

No need to panic over the wrong object. Your home fridge, if it isn't connected to anything, is not at risk of being taken to fifty degrees by a stranger. If instead it has an app, Wi-Fi, a manufacturer account, Mirai's rule applies: change the factory password, update the appliance's software, and if you don't need a remote feature, turn it off.

The real everyday risk for a fridge remains a power cut. US guidelines say a closed fridge keeps food safe for about four hours, a full freezer for about forty-eight, but only if nobody opens the door.^[12] A thermometer that costs a few euros inside the fridge and another in the freezer lets you see with your own eyes what is happening, without trusting a little light. If you keep supplies at home, the list in Item90, room by room helps you decide what to keep out of the freezer and what not; for light, there's the minimum physical kit.

The supermarket cold rooms had a login page reachable from the internet and a password calculated from the date. Almost forty years after the Morris worm, the fix had existed since August 2025 and in October 2026 many units still hadn't received it.