Nobody is targeting you. You will get hit anyway.

On Monday morning, staff at the ICA supermarket in Sjöbo, a short drive from us here in Skåne, spent the day carrying spoiled food out of their freezers. Overnight, someone on the internet had set their fridges and freezers to 50 °C. Another ICA store in Stockholm put it more bluntly: “everything was destroyed.”

It was not just Sjöbo. Supermarkets in seven countries were hit the same night: Coop and ICA in Sweden, Delhaize in Belgium and Luxembourg, Carrefour, Intermarché, Colruyt, even the IKEA restaurant in Mons, plus Kesko in Finland, SuperValu in Ireland and a chain in Estonia. Three weeks before that, on 12 October, the same thing happened in France, where the cooling in as many as 700 supermarkets was pushed into defrost mode. Food losses there are estimated in the tens of millions of euros.

In the same few weeks, the tech press filled up with the “SMS of Death”: a single malformed text message that crashes the phone process on Android, drops any active call, emergency calls included, and can trap the phone in a reboot loop. The victim never sees the message.

Most people read headlines like these the way they read about earthquakes on the other side of the world. Strange, a bit scary, and nothing to do with them.

That reading is wrong, and it is the reason this keeps happening.

None of this took deep knowledge

Here is what the headlines rarely say plainly: these were not sophisticated attacks.

The supermarket controllers, mostly Danfoss AK-SM800 and AK-SC355 units, were running outdated firmware and could be reached from the public internet. Danfoss says it identified the security flaws last year and had “long recommended” that customers install the updates. No malware was needed. Rafe Pilling at Sophos compared it to “wearing rubber gloves and messing with the switches.”

The SMS of Death is even simpler to use. The bug is an integer cast in Android’s telephony code with no range check. A working proof-of-concept was published together with the write-up, as an installable app. You do not need to understand WAP Push, uintvars or NegativeArraySizeException. You need a phone number.

Finding these holes took skill. Using them, once they are public, takes almost none.

Most Android phones will never get the fix

Google fixed the SMS of Death in its October 2026 update, but only for Android 14 through 17. According to the researchers, phones on Android 12 and 13 run the same vulnerable code and are outside the security-update window. They will never be patched.

And that is the optimistic view, because it assumes that phones on Android 14 and newer actually get Google’s fix. Many don’t. Updates have to pass through the phone maker and often the carrier, and plenty of cheaper models get patches months late, or simply stop getting them after a couple of years. Look around any office, any school, any care home: a large share of the phones in use are already out of support, and their owners have no idea.

A phone that no longer gets security updates is not an old phone. It is a phone with a public list of ways to break it.

“We won’t be targeted”

This is what I hear most often from companies, usually with a shrug. We’re too small. We’re not interesting. Who would bother with us?

The uncomfortable part is that they are mostly right. Hardly anyone will sit down and pick out your company by name. But that is not how most damage happens anymore.

Attackers don’t start with a target. They start with a vulnerability. Then they scan the entire internet for anything that has it, which takes minutes today, and they hit every match. Nobody chose the ICA store in Sjöbo. It showed up in a list of reachable controllers running old firmware, together with thousands of others. According to Patrick Lamplmair of Tributech, “thousands of these controllers were still reachable from the internet after the French attack.” Three weeks of warning, and they were still sitting there.

You won’t be targeted. You will be swept up. The result is the same.

If your fridge, your camera system, your heat pump, your NAS, your router admin page or your building management system is reachable from the internet, someone can find it. Not because you are interesting, but because finding things is cheap and fully automated. The supermarket attacks hit commercial refrigeration controllers, not the fridge in your kitchen, but the principle is the same for anything that is online.

Kids and state hackers use the same tools

Who did the supermarket attacks? Nobody knows. The most plausible explanations, according to Sophos, are either a state demonstrating what it can do, or a lone hacker doing it for their own reasons.

Think about that for a second. One of the best threat-intelligence teams in the world cannot tell a nation-state from a bored individual. That is not a failure of analysis. It is because they use the exact same techniques. A public vulnerability, an internet-wide scan, a few commands. A teenager in a bedroom and a state-sponsored unit run the same playbook against the same unpatched devices.

So the question is not “who would want to attack us?” The question is “what do we have online that is broken?”

How holes are found now

As we wrote last month in The Zero-Day Lottery, the way vulnerabilities are found has changed for good. Finding new security holes is now mostly AI-driven. Deep expertise still helps a lot, because it points the tools in the right direction and makes everything faster, but it is no longer what limits how many holes get found.

The pattern looks like this:

1. Discovery. A researcher, a vendor, or an attacker, increasingly with AI doing the heavy lifting, finds a flaw.
2. Publication. A patch, an advisory, a CVE, and often a working proof-of-concept go public.
3. Mass exploitation. Now anyone can do it. The kids, the criminals and the states all start scanning for everyone who hasn’t updated.

The gap between steps 2 and 3 used to be weeks. It is now days, sometimes hours. Once a hole is public, the only thing between you and the people scanning for it is whether you have patched or disconnected.

“Updating takes time.” Disconnecting takes two seconds.

The usual objection is that updating is disruptive. Nick Jackson at Bitdefender noted that patches can take time to install and require downtime, which is a real problem for a food retailer. He also offered a simpler explanation: the people running the fridges are often not aware of the problem, because it is “not top of their agenda.”

Let’s be honest about the numbers:

• Pulling a vulnerable system off the internet takes about two seconds. Unplug a cable, disable a port forward, kill a 4G modem, close a firewall rule.
• Most updates take a few minutes. A firmware flash or a package upgrade is rarely more than a coffee break.
• An attack takes your whole night, and possibly your week. In Belgium, the company that runs Delhaize’s refrigeration had technicians out from 1 am, spending “all night and morning disconnecting the affected installations.” In France, individual supermarkets reportedly lost more than €130,000 each.

They ended up disconnecting anyway, just after the damage was done instead of before. And the same company said Monday’s attack would have been far worse if it hadn’t started patching after the French attack on 12 October. Patching works. It just has to happen before the scan reaches you.

A planned five-minute maintenance window is always cheaper than an unplanned week of cleanup. This is the same principle behind our own 150 ms tripwire: a bit of controlled downtime is nothing compared with the damage of staying exposed.

This is not a recommendation. It is a must.

Updating and hardening every system that touches the internet has been described as “best practice” for twenty years. The wording made it sound optional. It isn’t anymore. A minimum, for any company and honestly for any household:

1. Know what you have online. Make a list of every device and service reachable from the internet: routers, cameras, controllers, admin panels, remote-access tools. If you don’t know, that is your first problem.
2. Nothing that manages anything belongs on the public internet. Management interfaces go behind a VPN. We use a WireGuard mesh, but there are many ways to do it. A login page with a password is not a security boundary.
3. Patch it or pull it. If an update exists, install it. If it doesn’t, or you can’t do it right now, disconnect the device until you can.
4. Kill default passwords and default configs. Defaults are the first thing every scanner tries, and they are rarely as safe as they look. We have written about this even for nginx.
5. Separate things. The fridge, the cameras and the office laptops should not share one flat network. When one of them falls, it shouldn’t take the rest with it.
6. Retire phones and devices that no longer get updates. An Android phone on version 12 or 13 will stay vulnerable to the SMS of Death for the rest of its life. Treat it that way.

None of this is exotic. It is the basic hygiene that would have stopped every attack in this article.

Time to wake up

The world changed while most organisations were looking the other way. Finding vulnerabilities is now cheap and machine-driven, using them is trivial once they are published, and everything from cash registers to freezers is connected. Meanwhile, security is still treated as something you deal with after an incident, if the budget allows.

Systems can be made much harder to attack. Not impossible, nothing is, but hard enough that the internet-wide sweep passes you by and hits the next unpatched device instead. That takes knowledge, time and continuous attention, and in most companies nobody has that as their actual job.

It is time to stop hoping you are too small to matter and start paying people who know what they are doing. A security expert costs money. So does a store full of rotten meat, and only one of them stops the next sweep.