From the refrigerator to tap water and electricity: cyberattacks already affect everyday life

Raising the temperature of supermarket refrigerators in 12 countries to spoil tons of food. Taking websites around the world offline. Carrying out the largest cybertheft in history. Accessing personal data of the South Korean prime minister and his cabinet. Obtaining the medical records and financial information of nearly half a million Moldovans. This is the summary of what the most significant cyberattacks have achieved in just the past two weeks. Now widen the lens to the summer and the list grows to include problems in water distribution across 12 U.S. states and the hack of Australia’s health system. Analysts fear this may be the new normal: a scenario in which everything, including the physical world, can be destabilized with a few keystrokes and mouse clicks.We are living through a shift. Cyberattacks have surged recently, both in number and in sophistication. Recorded incidents rise year after year at double-digit rates. And, as the refrigerator episode shows, hackers’ power goes beyond stealing data or extorting companies: they can also interfere with the operation of critical infrastructure.Can we please stop posting about rogue AI and how it’ll kill us and go back to posting about all the cool vulns it is finding?— Charlie Miller (@0xcharlie) September 12, 2026 Artificial intelligence (AI) is responsible for the new landscape we are entering. The legendary hacker Charlie Miller — a former employee of the U.S. National Security Agency (NSA) and known, among other things, for being the first to hack iPhones and for taking over the braking, acceleration and steering of a Jeep Grand Cherokee in 2014 — clearly says that this technology has put us on a different screen. AI changes everythingThat is the point: AI has accelerated timelines, and that amounts to changing the cybersecurity playing field. This technology is a powerful ally for those trying to prevent cyberattacks, but also for those who design and carry them out. “AI can help identify zero-day flaws [those not yet discovered by anyone] and develop exploits [software that takes advantage of a flaw or vulnerability], all very quickly,” says Lukasz Olejnik, a cybersecurity consultant and researcher in the War Studies Department at King’s College London.Software is written in thousands of lines of code containing instructions the computer interprets and executes to perform different tasks. Operating systems, for example, can have millions of lines. The more complex the software, the more likely it is that there will be errors in that text. That error is what the industry calls a vulnerability. The purpose of software updates is to patch the bugs that are found so they cannot be exploited by cybercriminals.AI has upset the balance of that process. “We have entered an era in which discovering and exploiting vulnerabilities is much faster than fixing them,” Olejnik says. Data gathered by the Andreessen Horowitz Fund show the average time between the disclosure of a vulnerability and an attack to exploit it was 63 days in 2018. In 2025, an attack happens a week before the flaw or bug is disclosed.“AI can help attackers research targets, draft convincing messages, generate code and detect vulnerabilities in software. It can streamline and lower the cost of some phases of an operation, allowing the same actor to attempt more attacks. It’s a very significant change, even though many attack techniques are already known,” notes cybersecurity expert Mikko Hyppönen.It’s also reasonable to expect that this progression will not stop. “What worries me the most is full automation of the process. The fact that a program searches for weak points in another program changes the economics of attacks. As cost decreases, there are increasingly more targets worth attacking,” Hyppönen warns.From digital to physicalThe acceleration and democratization of cyberattacks is only part of the picture. The rest is completed by another element: the barrier separating the digital world from the physical one is eroding. You can recover a database if you have a backup, but you cannot recover spoiled food. “We live in a cyber-physical system in which physical devices are controlled or operated remotely by information technologies,” emphasizes Vladimir Dashchenko, lead researcher for Kaspersky’s critical and industrial infrastructure division.Back to last week, when a cyberattack raised the temperature of refrigerators and freezers in supermarkets across a dozen European countries, spoiling tons of food. The attack, identical to one carried out three weeks earlier, was also launched against the refrigerators of the agency that manages blood donations in France, although in that case it was stopped.This is not the first time a cyberattack has had real-world impact. In 2007, nearly 20 years ago, then–U.S. vice president Dick Cheney ordered the WiFi function of his pacemaker to be disabled. A year later, researchers at the University of Massachusetts managed to hack one of those devices to stop its pumping system at will. It was an early warning.There were more. In 2010, U.S. and Israeli intelligence services managed to introduce USB drives into Iran’s Bushehr and Natanz nuclear plants. Through that route, Stuxnet — a worm (a self-replicating virus that infects other computers) — was loaded onto their systems and physically damaged many uranium centrifuges.In 2014, a cyberattack caused failures at a steel mill in Germany that prevented a blast furnace from being shut down safely, causing “massive damage,” according to the BSI, the country’s national cybersecurity agency. In 2015 and 2016, with the annexation of Crimea still recent, Russia launched one of the most sophisticated attacks on energy infrastructure on record. “BlackEnergy and Industroyer managed to infiltrate control systems at Ukrainian substations. The attackers did not need to destroy equipment; they used the infrastructure’s own operational functions to interrupt service and leave tens of thousands of people without power in the middle of winter,” explains Josep Albors, head of research at the antivirus software firm ESET in Spain.The ransomware attack (system seizure) suffered by Colonial in 2021 was also highly publicized, forcing a precautionary shutdown of one of the largest U.S. oil pipelines and causing shortages in the country. The attack is attributed to the North Korean group Lazarus, which last week carried out the largest cyberheist in history, stealing $6.3 billion in cryptocurrencies from the Binance platform. This summer, hackers linked to Iran attacked 30 water facilities across 12 U.S. states, causing supply failures in some cities.The refrigerator incident is not an isolated event. These things were already happening. But now they happen more often. “Although cyberattacks against critical infrastructure have been occurring for a long time, their number has increased markedly,” Albors says.The new normalThere are extremely complex attacks that require months of preparation, planning and code development. That was the case with the first strikes against infrastructures, such as Stuxnet, which set back Iran’s nuclear program by several years, or BlackEnergy, which left thousands of Ukrainians without heating in the middle of winter.The refrigerator attack is simpler. Early investigations point to the use of weak or default passwords and outdated equipment. It’s a sign of the times. “The attack does not seem very sophisticated, and that should worry us even more: you don’t need to be a powerful actor to cause significant physical problems,” reflects Eusebio Nieva, technical director for Check Point Software in Spain and Portugal. “Today we talk about supermarket refrigerators, but tomorrow it could be healthcare facilities, industry, logistics or transportation,” he adds.There are more and more connected devices, so the attack surface keeps expanding. “You no longer need to break into a supermarket to destroy the food inside. What happened this week is the practical confirmation of ‘Hyppönen’s Law’: if it’s connected, it’s vulnerable,” Hyppönen says. Attackers’ motives are also unclear. “Some want money. Others, espionage. Some aim to sow chaos. In recent weeks we have seen all three, and the boundaries overlap,” reasons the Finnish computer scientist. Geopolitics? Opportunism? Profit motive? Probably a bit of each.What is also clear is that today’s attacks on physical infrastructure are not only more frequent but also more dangerous than those of a decade ago. “Our systems are fragile and contain much technical debt [the cost associated with choosing lower-quality solutions in software development] that has accumulated over recent decades. Fixing that will take time, and meanwhile we risk suffering the perfect cyberstorm,” Olejnik warns.Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition