Yes, a connected refrigerator can be hacked. To secure a refrigerator from being hacked, find out if it is online, change the password it came with, switch on updates and the extra sign-in code in the maker's app, move it to a separate Wi-Fi network from the tills, switch off remote access nobody uses, and repeat for every connected device.
That order comes straight from the October and November 2026 attacks on supermarket chains in several countries. Attackers remotely changed the settings on the controllers that run display refrigerators and cold rooms, forcing them into a long defrost with settings reported as high as 50°C, and whole aisles of fresh and frozen food went in the bin; one small butcher put his loss at roughly $11,000–$17,000 of meat in a night. The national cyber agency that investigated the first wave found no clever trick: the controllers could be reached directly from the internet, they were administered without particular safeguards, and some had weak passwords. The controller maker added that most units hit were old models it had stopped updating, or newer ones never given the available update. No ransom was demanded, and no investigator or retailer has reported any data theft. A refrigerator controller is a small computer with a login page, and so are your cameras, tills and printers, which makes this a business problem rather than a gadget problem.
What the supermarket refrigerator hackers actually did
The first wave came overnight on 11–12 October 2026 and hit hundreds of supermarkets in one country, about 700 according to that country's government. The second came overnight on 1–2 November and reached at least six more countries, with reports from several others in the days after; this time small shops and butchers were caught as well as chains. Most chains lost stock in a small share of their stores, from a single store to a few dozen each. One report says the defrost was stretched from one hour to eight, which delayed the alarms.
A few businesses caught it fast. One chain said its own monitoring alerted it and it pulled chilled and frozen stock the same day. At one store the refrigeration contractor reversed the change in about ten minutes and nothing was lost.
Why were the controllers online at all? The maintenance firm wants to see alarms and change settings without sending an engineer, and many of those links run over a mobile-data (4G) modem the contractor fitted: a small box with a SIM card that reaches the internet over the phone network. That is why, as one security specialist told reporters, some owners did not know their refrigerators were on the internet.
No malicious code appears to have been used on the controllers, no ransom was demanded, and a security firm said there is no evidence AI was used. Nobody has been shown to be behind either wave: when two self-styled hacktivist (political hacker) groups claimed them in early November, investigators and security firms said the claim could not be verified. None of the ways in were new, either. The same five doors have been used on cameras, printers and controllers for a decade:
| The door | A real case | Where it gets shut below |
|---|---|---|
| Reachable from the internet | 2026: researchers' scans found thousands of refrigeration controllers whose login pages anyone could reach from the open internet. | Switching off remote access; the ten-minute outside check |
| The password it came with | 2016: malware logged in to hundreds of thousands of cameras and video recorders with their factory usernames and passwords, and the traffic it sent made some of the world's biggest websites unreachable for much of a day. Late 2023: attackers took over water-plant controllers over the internet with the maker's default password, 1111. | Passwords and staff rules |
| Old software on a model the maker dropped | 2026: the controller maker said most units hit were models it no longer updated, or newer ones never given the update. | Updates |
| A contractor's login nobody closed | 2013: attackers first got into a large retailer's network with a login stolen from its heating-and-refrigeration contractor (a link used for billing, not for running equipment), and about 40 million card accounts may have been affected. 2021: an intruder had access to more than 150,000 live security cameras after finding an administrator login on the camera company's own support server, left reachable from the internet. | The maintenance company's remote login |
| One flat network where the refrigerator can see the tills | 2025: a ransomware gang (criminals who lock a firm's files for payment) blocked on a company's computers found an unsecured webcam with known security holes on the same network, with no security software on it, and used it to encrypt the company's files. The write-up did not say what the business does. | A second Wi-Fi network |
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowHow to secure a refrigerator from being hacked, kitchen to cold room
A business usually owns up to three kinds of refrigerator, and each hides its connection in a different place. One security firm's rule after the attacks is the right starting point: assume it is on the internet until you have checked.
Three kinds of refrigerator, three places the connection hides
| Kind of refrigerator | Where the connection hides | Who usually put it online | What an attacker could do |
|---|---|---|---|
| Home-style smart refrigerator in the staff room or office kitchen | A network name under Settings > Wi-Fi on its screen; the maker's app on someone's phone | Whoever set it up, often a previous manager or owner | Reach the account behind it; use it as a way onto your Wi-Fi |
| Display refrigerator or cold room run by a controller | A network cable from the controller box in the plant room, or a small box with an aerial nearby | The refrigeration contractor | Change the set temperatures (setpoints) and defrost schedule for every cabinet at once |
| Temperature logger | A gateway plugged in near the refrigerator that sends readings to the maker's online service (the cloud) | You, or whoever handles food safety | See your readings and change the alert limits through the account |
The middle row is the one that cost the supermarkets. One supermarket manager's first warning was a call from his monitoring company at about 4 a.m. saying temperatures were rising in the freezers and cold rooms. In his words: "there was no more cold, just hot air coming out."
Each step below is tried on one illustrative business: a family-run food shop with a cold room, three display cabinets, a staff kitchen, a back office and about 15 connected devices. Its decision, with the time and cost, closes each section.
The smart refrigerator in the staff kitchen or behind the counter
The first question is whether it needs Wi-Fi at all. If nobody uses the screen's online features, switch the Wi-Fi off in the refrigerator's settings: the cooling does not depend on it. Samsung publishes no list of what keeps working offline, but the features that plainly need the connection are viewing from a phone, mirroring to a TV, app updates and setting the clock automatically. If staff do use them, the refrigerator goes on the guest network, a second Wi-Fi name the router keeps apart from the main one (the router steps come later). A second name on its own is not a barrier: the separate 2.4 GHz name some routers offer, or an extra name on the same network, is the same lane with a different label. Only a network the router marks "guest", or a VLAN (a separate lane inside the same network that devices cannot cross; the network section below explains it), keeps devices apart. The menu names and prices in this tutorial are the makers' own as checked in early November 2026; on your model the wording may differ slightly, and store prices change.
| Job | Where to do it |
|---|---|
| Update the refrigerator's own software | Samsung Family Hub: swipe down from the top of the screen > Settings > About Family Hub > Software update |
| Keep its apps current | Apps > Settings > switch on Automatic Update (apps then update at 7:00 a.m. daily) |
| Two-step verification on the Samsung account: a code from your phone as well as the password (makers also call it 2FA or MFA) | On a phone: Settings > your profile > Security and privacy > Two-step verification. Choose text message or an authenticator app (a phone app that shows a fresh code every 30 seconds), and tap Save codes for backup codes. Samsung's help page says it cannot be disabled, while its Family Hub page warns the refrigerator screen may not accept a two-step login; if that happens, contact Samsung support rather than looking for an off switch. |
| See who controls it | The separate Family Hub phone app is discontinued. Open the refrigerator in the SmartThings app, then its settings (the gear icon); check who it is shared with, remove old users, and remove the refrigerator from the account before you sell or scrap it. |
| LG ThinQ refrigerators | Look for a verification option under the account menu in the ThinQ app; LG's help pages did not describe one when checked, so use a long unique password. LG's manuals list a firmware (built-in software) update feature in the app for Wi-Fi models. |
None of this is theoretical: in 2015 security researchers showed that one smart refrigerator could leak its owner's email login, because it did not check it was really talking to the right server before handing the password over.
The food shop's decision: the kitchen refrigerator was still signed in to the previous owner's Samsung account. The owner signed it out, created a business account with two-step verification, ran the software update and moved the refrigerator to the guest network. Time: 20 minutes. Cost: $0.
The display refrigerator and cold room run by a controller box
Display cabinets and cold rooms are run by a controller: a small computer in the plant room or behind the cabinets that holds the setpoint (the temperature the controller is told to hold) and the defrost schedule for every cabinet, with its own web page and login. The maintenance firm put it online so it could see alarms and fix settings without a visit. The safe version of that link is a VPN, a secure private connection the contractor opens from their end so only they can reach the controller. The unsafe version is a controller with a public address (the address the internet sees your shop at), a port forward (a hole punched in the router so something outside can reach one device inside) or a contractor's modem that anyone who finds it can reach.
| Controller | What to ask the technician to set, in the maker's own words |
|---|---|
| Danfoss AK-SM 800A | Configuration > Security: Session Control "Strict" (the default from software 4.0.x, and Danfoss recommends it); "Use HTTPS" set to Yes (the padlock version of its web page, which scrambles the login on the way); the "Internet" switch, which the guide says allows remote communications to the unit, set by the technician to suit the VPN once it is in place; what you insist on is no public address and no port forward. From release 4.3.1 the unit forces a password change at first login and expires passwords after 90 days. Danfoss cannot recover a forgotten password; support issues a one-off login valid for 16 hours. |
| Danfoss AK-SM 800 and AK-SC 355 | No longer updated: the AK-SM 800 reached end of life in 2021 and the AK-SC 355 was phased out in 2016. Danfoss says the factory login must be changed on these. Take them off the internet now and put them on the replacement list for the next service. |
| Copeland E2, E3 and Site Supervisor | The E2's first login is the factory pair USER / PASS, and Copeland's own guide says to replace it. The start-up technician's temporary administrator account "is to be deleted" afterwards. E3 and Site Supervisor need firmware 2.31F01 or later, because older versions had a built-in support login with a guessable daily password (Copeland reports no exploitation). Network settings sit under Main Menu > System Configuration > Remote Communications. The E2 is reported to be at or near end of life. |
| Carel boss | Configuration > User configuration > Users > Safe account policy: an expiry date for every account and a login-retry limit that blocks the account. The boss manual says remote service access "should only be kept active for the time strictly necessary". |
The makers now say the same thing in public: Copeland's product security page tells owners to keep controllers off the public internet and never use port forwarding or public addresses, and Danfoss's cybersecurity best-practice page says to protect the device from direct internet exposure and change default passwords at commissioning (the day the system is first set up and switched on).
Four cautions before anyone touches it. A factory reset does not fix a controller that has been tampered with: one national cyber agency warned that a reset unit put back online with the same exposure will very likely be hit again. The same agency told shops to check their insurance contract terms before cutting the contractor's data link. Ask the contractor to keep a saved copy of the controller's settings (setpoints, defrost schedules, alarm limits, user list) and to export a fresh one after every change: Copeland's page tells owners to "maintain current backups and regularly review logs", and Danfoss's system manager can export its database to a USB stick. After a tampering the fix is then a restore, not a rebuild from memory. And the controller's software is installed by the technician, not by you, so ask for the version number in writing. A short message does it:
Subject: Our refrigerator controller and your remote access
Hello [contractor contact],
After the October and November 2026 attacks on supermarket refrigeration,
please answer these four questions in writing for [shop name]:
1. Can our controller be reached from the internet, and how: a public
address, port forwarding, or a mobile-data modem you fitted?
2. Has the password it came with been changed, and who at your firm
holds the logins?
3. What software version is it on? Is that the latest the maker still
supports? If the model is no longer supported, what is the quote to
replace it?
4. How do your engineers connect, and can that move to a private
connection (VPN) that is only switched on when we ask?
Thanks,
[your name]The food shop's decision: its controller turned out to be reachable over the contractor's 4G modem, and the login was printed in an old manual left in the plant room. The fix was the contractor's VPN, a new login, the software update and the modem's open route closed. Time: a 15-minute call for the owner plus an hour of the contractor's time (ask for the rate first).
A temperature alarm that does not trust the controller
The businesses that lost least in 2026 were the ones whose alarms worked. One national cyber agency's advice after the attacks was to check real temperatures with tools that do not depend on the controller. An independent logger on its own account and on the guest network does exactly that.
On the makers' own stores, SensorPush's HT1 sensor was $54.95 and the HT.w $69.99, plus $99.95 for the G1 Wi-Fi gateway that sends alerts "from anywhere" with "no monthly fee". testo's Saveris 2 Wi-Fi logger alarms by email or, optionally, text message when a limit is crossed, and Monnit sensors need a Monnit gateway; neither testo nor Monnit prints a price on its product pages, so ask the maker or a reseller for a quote. Ask the contractor what each cabinet reads at the end of a normal defrost and set the alert above that peak, with any alert delay the logger offers set longer than a defrost; a logger with an external probe can read a bottle of water, a stand-in for the food, rather than air. Put the gateway within a few metres of the cold room and test the alert with the door shut, because insulated metal walls shorten the sensors' reach. Send alerts to two phones, and make sure one of them is answered at 3 a.m. If you already export logger readings, using AI to flag breaches in cold-chain temperature logs turns those files into a short list of exceptions.
What a warm cold room costs against an afternoon of settings
A quick sum for the food shop, with illustrative figures:
| Cost of one bad night | Illustrative figure |
|---|---|
| Chilled and frozen stock at cost (cold room plus three cabinets) | $7,500 |
| Disposal and deep cleaning | $300 |
| A day's lost chilled sales | $1,200 |
| Emergency refrigeration call-out | $300 |
| Total | about $9,300 |
Against that, the week-one plan itemised near the end takes about seven and three-quarter hours of the owner's evenings and $470–$620 in cash. The reported losses put the sum in scale: beyond the butcher's roughly $11,000–$17,000, one chain's chief put a hypermarket's losses at roughly $203,000–$225,000, the group hit hardest said its losses ran into millions, and one retailer warned that its insurance may not cover this kind of in-store incident. Read your policy wording before you need it; what cyber insurers ask before they cover you is worth an evening.
Now stand at the router. On the same network as the kitchen refrigerator sit the till, the camera recorder, the printer and the TV in the window. Each is a small computer with a login page, and the same steps protect your cameras, tills and printers; the next section does them once for the whole building.
How do I protect every other smart device in my shop?
Make the list first, then shut the doors in the order below; the device sections after this say where each switch lives on each maker's menus. For the wider set of risks a small business carries, from email to AI tools, see the AI security risks small businesses face and how to close them.
Write down every device, from the cold room to the doorbell
Walk the building with a phone and photograph every box with a light, a cable or an aerial: plant room, counter, office, stockroom, staff kitchen, back door. If a contractor's quote or an insurer's form says "IoT devices", it means exactly these: anything in the shop with Wi-Fi or a network cable. Here is the food shop's list after the walk (illustrative), with the honest gaps left as questions for the contractors:
| Device | Connects by | Who else can log in | Still updated? | Reachable from outside? | Belongs on |
|---|---|---|---|---|---|
| Cold-room and cabinet controller | Cable to the contractor's modem | Refrigeration firm | Ask the contractor | Ask the contractor | Contractor's VPN only |
| Contractor's 4G modem (box with aerial) | Mobile data | Refrigeration firm | Unknown | Yes, it has its own public address | Contractor's VPN only |
| Staff-kitchen smart refrigerator | Wi-Fi | Previous owner's account | Yes | No | Guest network |
| Four cameras | Cable to the recorder | Camera installer | Unknown | No | The recorder's own ports |
| Video recorder | Cable to the router | Camera installer | Updates from a file | Yes: a port forwarded for phone viewing | Off the router, viewed on the office screen |
| Video doorbell at the delivery door | Wi-Fi | Owner and manager | Yes | Through the maker's app | Guest network |
| Till tablet | Wi-Fi | Till provider | Yes | No | Main network |
| Card reader | Bluetooth to the till | Payment provider | Yes | No | Paired to the till only |
| Label and invoice printer | Wi-Fi | Anyone: password from the label | Unknown | No | Main network |
| Internet provider's router | Cable from the provider | Internet provider | Unknown | Settings page: check | It is the network |
| TV in the window | Wi-Fi | Nobody else | Yes | No | Guest network |
| Thermostat | Wi-Fi | Heating engineer's old invite | Yes | Through the maker's app | Guest network |
| Alarm panel | Cable, plus the installer's app | Alarm company | Unknown | Ask the alarm company | Its own link, agreed in writing |
| Smart speaker on the counter | Wi-Fi | Owner's shopping account | Yes | No | Guest network |
| Two smart plugs for the sign lights | Wi-Fi | Owner | Unknown | No | Guest network |
A chat assistant such as ChatGPT, Claude or Gemini can turn the photos into a first draft of that list. Check first that the photos show no customers' faces, no screens with logins on them, and no stickers showing a password, PIN or Wi-Fi key: cover them with a finger or crop them out (the router's and the printer's labels are the usual ones). Use a business account on the assistant whose settings say your uploads are not used for training. A prompt that works:
I run a small food shop and have taken 14 photos walking round the plant
room, counter, office, stockroom, staff kitchen and back door. For every
device in the photos that could have Wi-Fi, a network cable, a mobile-data
modem or Bluetooth (refrigerator controllers, boxes with a SIM card or aerial,
cameras and their recorder, the doorbell, till and card machines,
printers, the router, screens, speakers, thermostats, the alarm panel,
smart plugs, chargers, temperature loggers), give me a table with:
device; maker and model only if visible on a sticker; where it is; how it
probably connects; who likely set it up (us, the refrigeration firm, the
alarm company, the camera installer, the till provider, a previous
owner); and three questions to answer: has the factory password been
changed, does it update itself, can it be reached from outside the shop.
Mark anything you are guessing with "guess". Plain words, no jargon.Part of a typical reply (illustrative):
| Device (assistant's words) | How it probably connects | Likely set up by | Assistant's note |
|---|---|---|---|
| Refrigeration controller, model AK-SM 8xx (guess) | Network cable | Refrigeration firm | Check the factory password |
| Wi-Fi extender behind the cold room | Wi-Fi | Us | Probably fine |
| NVR with four PoE cameras | Cable to the router | Camera installer | Updates automatically |
| Till tablet | Wi-Fi | Till provider | Cloud-managed, secure |
| Brother label printer (sticker visible) | Wi-Fi | Us | Factory password changed? |
| Samsung smart refrigerator | Wi-Fi | Previous owner | Sign out of the old account |
What to fix before trusting it. The model number was guessed from a blurred label, so read the sticker yourself. The "Wi-Fi extender" is the contractor's 4G modem, the most important box in the building. The Bluetooth card reader is missing altogether. "Cloud-managed, secure" for the till is the assistant's assumption, not evidence. This recorder updates from a file, not automatically. And "NVR" and "PoE" are trade words to rewrite in shop words: the video recorder, and cameras powered through their network cable. The assistant drafts the list in five minutes; you check every row against the labels.
Which devices go on a separate Wi-Fi network, and how?
The cheapest barrier is the router's guest network with both of its boxes unticked: "allow guests to access my local network" (untick it and guests cannot reach the till side) and "allow guests to see each other" (untick it and a hacked plug cannot reach the doorbell; the trade calls this client isolation). The makers word it differently. On TP-Link routers it is Advanced > Guest Network, with both boxes left unticked. Netgear's Orbi leaves "Allow guests to see each other and access my local network" cleared by default. ASUS has "Access Intranet", off by default. Google Wifi lets you pick the "Shared devices" guests can reach, so share none. One trap: the usual home-and-shop set-up is a mesh kit (eero, Deco, Orbi, Google Wifi: several boxes sharing one Wi-Fi name) running behind the provider's box in access-point or bridge mode, where the kit only spreads that box's network instead of running its own. In that mode the mesh app's guest network may not isolate at all (Deco shows an "Allow Local Access" switch there: leave it off), so either run the guest network on the provider's box or put that box into modem mode (it then only carries the internet in) so the mesh becomes the router. On UniFi gear the barrier is a separate network for the devices with "Network Isolation" and "Client Device Isolation" switched on. Whatever you have, test it by trying to open the printer's page from a phone on the guest network.
Who goes where: the till (with its Bluetooth card reader), the office printer and the office laptop stay on the main network; the kitchen refrigerator, doorbell, TV, thermostat, speaker, plugs and, later, the logger gateway go on the guest network. Customer Wi-Fi never shares the till's network: the card industry's guide for small merchants says that if you offer free Wi-Fi, you should "use another network for your payment system". If you offer customers free Wi-Fi, on many provider routers it is this same guest network. That is acceptable only with "allow guests to see each other" unticked, so a customer's phone cannot reach the plugs or the doorbell. If your router offers two guest networks (some mesh kits and all the VLAN boxes below do), give customers their own and keep the devices' password private. Isolation also stops pairs that must talk, such as a camera and its recorder or a till and its receipt printer, so keep each pair on the same side or wired together.
A VLAN is the grown-up version: a separate lane inside the same network that devices cannot cross, with as many lanes as you need, and lanes can be given one-way rules (the office can reach the cameras; the cameras cannot reach the office). It needs three things: a router that understands lanes, Wi-Fi access points that broadcast one network name per lane, and, for any wired device on a lane, a switch that understands lanes. The one-box answer for a small shop is a UniFi Express 7 from $199 or a Dream Router 7 at $279, both with the Wi-Fi built in. The cheaper boxes have no Wi-Fi of their own: TP-Link's Omada ER605 (listed at $79.99, on sale at $59.99 when checked) plus its OC200 controller (listed at $109.99, $85.99 on sale), or a UniFi Cloud Gateway Ultra at $129, each need at least one access point from the same maker (UniFi's U7 Lite is $99 and its U7 Pro from $189). The Firewalla Orange ($399 on its own store when checked, marked down from $429) has Wi-Fi 7 built in for around 50 devices and up to five lanes; check with the maker that it will broadcast a separate name per lane before buying. Whichever you choose, the provider's box must go into modem (bridge) mode, or have its own Wi-Fi switched off, or the old flat network stays alive beside the new one.
The food shop's decision: its internet provider's router already had a guest network with isolation, so no new kit in week one. Seven devices moved across in an hour.
Passwords, the extra sign-in code and six staff rules
Change every factory login the day you find it. The card industry's small-merchant guide is blunt: equipment "often come[s] with default (preset) passwords such as 'password' or 'admin,' which are commonly known by hackers and are a frequent source of small merchant breaches". Give each person their own login and never share one. A shared password manager keeps that workable: Bitwarden Teams is $4 per user per month billed annually, and 1Password's Teams Starter Pack works out at about $25 a month billed annually for a team of 10 (its pricing page shows $2.49 per user a month, with a 10-user minimum and up to 20 users). The method is the same one used for sharing AI tool logins safely through a password manager.
Then switch on two-step verification, the extra sign-in code from the first paragraph, wherever the maker offers it. Samsung, Google and Amazon accounts offer it; Ring and UniFi make it compulsory. I could not find a sign-in code option on the makers' help pages for LG ThinQ, Honeywell Home and Resideo, Wallbox, myenergi, SensorPush or testo, so give those a long unique password from the manager. Then pin up six rules:
- Nobody shares a login or reads a code out to a caller, whoever they say they are.
- Leavers are removed from every app the day they go.
- When someone who knew the main Wi-Fi password leaves, change it the same day; with the devices on the guest side, only the till, the laptop and the printer need re-joining.
- Nothing new joins the Wi-Fi or plugs into the router until it is on the device list.
- A request to change a refrigerator or alarm setting comes from the contractor's named contact and is confirmed by calling the number you already hold.
- Any email asking someone to "confirm" a login for the refrigerator, cameras or till goes to the manager unanswered.
The last rule matters more each year. Picture a clean, well-written email that appears to come from the refrigeration company, asking the manager to confirm the controller login "for the new monitoring portal". That is how a first password usually leaves a building, and AI writing tools make such emails easier to produce without the clumsy wording staff used to spot. Training staff to spot AI-written phishing emails is the companion to these rules. A chat assistant can also draft the six rules as a one-page notice for the staff room; read it before printing, because it tends to add rules nobody can enforce.
What if the maker has stopped updating my refrigerator controller?
Firmware is the software built into the device, and it is where most security fixes arrive. Switch on automatic updates wherever the maker offers them (the router paths are in the router section; eero and Google Wifi update themselves), and put a quarterly reminder in the diary for devices that update from a file.
The harder case is a device the maker has stopped updating. Most of the controllers hit in 2026 were models phased out in 2016 and 2021, or newer ones never given the update. One national cyber agency warned that an unsupported device left online will very likely be hit again, and one refrigeration contractor said older units need physical changes that cost money, beyond any software update. That leaves three choices for any device with no more updates: take it off the internet entirely, give it a lane of its own with nothing else on it, or replace it on a dated plan.
The law is catching up, but only for what you buy next. One country's rules for consumer connected products have banned universal default passwords since 29 April 2024, and a second country's smart-device rules took effect on 4 March 2026. The EU Cyber Resilience Act entered into force on 10 December 2024; its vulnerability-reporting duties apply from 11 September 2026 and its main obligations from 11 December 2027, when products in its scope must be secure by default and, in most cases, get security updates for at least five years. The voluntary Cyber Trust Mark label had its rules adopted in March 2024, but no labelled products were in shops as of late October 2026, and it excludes industrial and enterprise equipment and routers, so a refrigerator controller falls outside it. None of this changes what is in your plant room today.
Which remote-access settings should I switch off?
Three router features open doors from the outside, and most shops need none of them. UPnP is a setting that lets devices open doors in the router by themselves. Port forwarding is the hole described in the controller section: one device inside made reachable from outside. Remote management makes the router's own settings page reachable from the internet; TP-Link ships it switched off for that reason. Before you delete a port forward, find out what it serves: the router page shows the device address next to each one, and your device list says whose it is. If it points at the controller, the alarm panel or anything a contractor monitors, agree the replacement with them first (their VPN, or the device sending alarms out) and delete the forward the day the replacement goes live, not before. Everything else goes now. Switch all three off, then the makers' cloud features nobody uses, such as Hik-Connect or P2P on cameras. Leave on only what someone genuinely uses from outside, protected by two-step verification: a doorbell's app, say, and the contractor's VPN. The device sections below give each switch's location.
How do I check what the internet can see of my shop?
This ten-minute check needs a phone and a laptop on the shop Wi-Fi:
- On the shop Wi-Fi, open api.ipify.org: it shows your public address as plain text. Write it down with the date; on many provider contracts it changes when the router restarts, so take a fresh reading every time you repeat the check. If your internet comes over a mobile signal, or your provider shares one address between customers, the address shown is shared: results under it may be someone else's, and nothing inside your shop can be reached from outside through it. The contractor's modem is then the only door to check.
- Look that address up on Shodan, a search engine for internet-connected devices (a free account works; the $49 one-off Membership shows more and can monitor 16 addresses), and on Censys, whose free account gives "basic visibility into standard ports and services".
- Run GRC's ShieldsUP, which probes your connection from outside, from a laptop on the shop Wi-Fi (not a phone on mobile data). Its "All Service Ports" button checks only the lowest-numbered ports, about a thousand of them (the numbered doors a device listens on), so also type into its custom-port box the ports your installers used: ask each of them, and try 80, 443, 554, 8000, 8080 and 37777 if nobody knows. It says it keeps nothing it learns.
- Inside the shop, scan the Wi-Fi with the Fing app: the free tier allows up to three scans a day and lists every device; Premium ($8.99 a month or $79.99 a year) alerts you to new devices and can block unknown ones. Your IT contractor may prefer nmap, a free network scanner.
A clean result means nothing on Shodan or Censys under your address, nothing open in ShieldsUP including the custom ports, an empty port-forwarding page on the router, and Fing's count matching your device list while everything is still on one network (after the guest move, use the router's client list instead). Three caveats. A clean scan is a snapshot, not proof. A controller on the contractor's 4G modem has its own public address, so it will not show under yours; only the contractor's written answer settles that one. And "behind the router" is not "safe". The outside check shows only what a stranger on the internet can reach. The office laptop that opens email sits inside, next to the till and the printer, and one convincing email can put an attacker on it. In the 2025 webcam case in the table above, the attackers came in through a remote-access login instead, then scanned the network from inside and found the camera. That is why the devices go on a lane the laptop cannot reach, and why, if your router can make a third lane, the till gets one of its own (the 12-branch plan below uses three). If you do find a device that is exposed and still on its factory password, one joint government advisory's rule applies: assume someone has already been in, and follow the morning plan further down.
Cameras, the recorder and the video doorbell
Cameras are the device most often taken over in bulk, and their settings are spread across the camera, the recorder and the maker's cloud app. The changes by maker:
| Maker | What to change |
|---|---|
| Hikvision | Activate with a strong password (the camera will not work until you do). Update firmware at Maintenance and Security > Maintenance > Upgrade. Switch UPnP off at Configuration > Network > Network Service > NAT. Keep "Enable Illegal Login Lock" on under Maintenance and Security > Security > Login Management (by default seven failed attempts block the address for 30 minutes). Delete inactive users under Configuration > System > User Management. If nobody watches from outside, switch off Hik-Connect (Hikvision's camera guide puts it under Platform Access; on current firmware look under Configuration > Network). |
| Dahua | P2P, the maker's cloud link that lets a phone app reach the recorder from anywhere (Setting > Network > P2P), is on from the factory: switch it off if unused; keep UPnP and SSH (a text-command way in used by technicians) off; give the separate ONVIF user (the login that lets another maker's recorder pull the camera's video) its own password. These menu names come from Dahua's 2017 hardening guide and may differ on current firmware. |
| Axis | The camera will not run until an administrator password is set; disable services you do not use; create a separate viewing account for daily use. |
| Ring | Two-step verification is compulsory. Control Centre lists every logged-in phone, tablet and computer, with "Remove all". Invite staff as shared users with "Limited" permission (invitations last 14 days); a professional-installer invite is removed automatically after 48 hours. |
| Google Nest | Google 2-Step Verification on the account; staff added as Home members, never a shared login; leavers removed with "Remove this person". |
| Reolink | 2FA under Account Details > Security on the Reolink website, with backup codes. |
The food shop's decision: the four cameras stay wired into the recorder's own camera ports, so they never touch the Wi-Fi; nobody needs to watch from outside, so the recorder comes off the router, is watched on the office screen and has its update in the quarterly diary; the doorbell stays on its cloud app with two-step verification. Time: 55 minutes.
The recorder that anyone on the internet could log in to
The ten-minute check found the illustrative food shop's worst problem straight away. The installer had forwarded a port on the router so the owner could watch the cameras on a phone, and the recorder's login page showed up under the shop's public address, still on the installer's password. Nothing in the shop looked wrong; the only sign was that search result. The fix took 45 minutes: forward deleted, UPnP off on the router and the recorder, password changed, recorder unplugged from the router. Two safe ways keep phone viewing: put the recorder on the devices' lane and use the maker's cloud app (Hik-Connect, Dahua's P2P) with the sign-in code on, so the recorder connects outwards and nothing is open inbound; or switch on the VPN server many routers include (ASUS, UniFi and Firewalla among them; check your model's manual) so your phone joins the shop network before it opens the recorder. Only if nobody needs remote viewing does the recorder come off the router, and then it gets its updates from a file and sends no alerts, so diary the quarterly update.
Printers and copiers: the password nobody changed
Every networked printer has a settings page you reach by typing its address into a browser, and many ship with a password on a label or none at all. Printing itself works on the local network; only cloud-print services need the internet, so switch those off unless someone uses them.
| Maker | Where the password and settings are |
|---|---|
| HP | The printer's web page > Settings > Security > Password Settings (8 to 16 characters; HP warns that a lost password means a factory reset, so store it). Untick protocols you do not use under Network > Advanced Settings. |
| Brother | The default password is on a label on the back marked "Pwd". Change it at Administrator > Login Password. |
| Epson | Web Config > Product Security > Change Administrator Password. A 2024 report said Epson web pages with no administrator password set could be taken over by whoever reached them first. |
| Canon | The administrator password must be changed on the printer itself (Setup > Printer settings > Administrator password settings) before its web page will open. |
The food shop's back-office printer was still on the password from its label, and every phone on the shop Wi-Fi could reach it, customers' phones included. The Fing scan listed it; typing its address into a phone's browser opened the settings page, and the label password let anyone in. Ten minutes fixed it. Printers have been abused this way before: in 2018 a prankster claimed to have made tens of thousands of printers print a flyer, and the only trick was that they were reachable from the internet with their printing port open.
The Wi-Fi router's settings page, before and after
The router is the front door for everything else. The food shop's router, before and after 40 minutes of changes, with TP-Link menu names and the Netgear and ASUS equivalents where they differ. WPS is the push-button pairing feature; WPA3 is the newest Wi-Fi security setting, which the Wi-Fi Alliance says gives "increased protections from password guessing attempts".
| Setting | Before | After | Where to find it |
|---|---|---|---|
| Router admin login | The password on the sticker | A long unique one, kept in the password manager | TP-Link: Advanced > System > Administration. Netgear: ADVANCED > Administration > Set Password (Netgear's factory default is admin / password) |
| Main Wi-Fi password | The one on the sticker, known to the previous owner, two ex-staff and three contractors | A new long one, handed to staff through the password manager; the new guest network has its own | Under the Wireless settings, next to the security setting |
| Remote management | On | Off | TP-Link: the same Administration page (it ships off). Netgear: ADVANCED > Advanced Setup > Remote Management. ASUS: Administration > Remote Access Config > "Enable Web Access from WAN" |
| UPnP | On | Off | TP-Link: Advanced > NAT Forwarding > UPnP. ASUS: Advanced Settings > WAN > Basic Config (ASUS ships it on) |
| Port forward to the recorder | Present | Deleted | Usually near UPnP, under a name such as Port Forwarding or Virtual Servers |
| WPS | On | Off | TP-Link (older pages): System Tools > System Parameters > WPS. Netgear: tick "Disable Router's PIN" |
| Wi-Fi security | WPA2 | WPA2/WPA3 mixed (WPA3 alone if every device accepts it); if a plug, logger or printer drops off after the change, that device cannot do WPA3: keep mixed mode rather than WPA3 alone, and note the device on the replacement list | Under the Wireless settings |
| Automatic firmware updates | Off | On | TP-Link: Advanced > System > Firmware Update > Enable Auto Update. Netgear: ADVANCED > Administration > Router Update. ASUS: Administration > Firmware Upgrade |
| Guest network | Off | On, both "allow guests" boxes unticked; seven devices moved | TP-Link: Advanced > Guest Network |
| The refrigerator controller | Not on this router | Unchanged here | It sits on the contractor's modem, so it was fixed through the contractor |
After the changes, save the router's settings file (usually under Backup or System Tools) and the recorder's configuration somewhere safe, such as the password manager, so a reset or a replacement box is a restore rather than an evening of menus. If your provider's box has no guest network, or no way to stop guests reaching the main network, that is when the VLAN kit above earns its place: a router with the Wi-Fi built in, or a gateway plus an access point where the box has no Wi-Fi.
Tills, card machines and the self-service kiosk
Tills are usually the best-protected devices in a shop, because payment providers enforce much of it. Your job is to switch on what they offer and stop staff sharing one code.
| Provider | What to switch on |
|---|---|
| Square | Settings > Account & Settings > My business > Security > "Two-step verification for team members". Give each team member a personal passcode (a shared Team passcode cannot show who did what); device codes expire if unused for 48 hours; set auto-lock to "After time-out". |
| Clover | Setup > Account Settings > Two-Factor Authentication, which Clover requires before you can issue refunds or change bank details. Passcodes are 4 or 6 digits; one regional help page says new merchants must use 6 from April 2026, and regions may differ. |
| Toast | Profile > Login and security > Multi-factor authentication, required for account-admin permissions. Each POS access code must be unique, three to eight digits. |
| SumUp | Login and security > Add security; codes arrive by email or text message. |
| PayPal Point of Sale (formerly Zettle by PayPal) | An email code when you sign in from a new device (a device used in the last 24 hours is usually let through), which cannot be switched off. On the Terminal: Settings > Security for the screen lock and passcode, and Settings > General > Daily restart. |
The card industry's small-merchant guide adds four rules in plain words: keep the payment system on another network from free customer Wi-Fi; never use the till for anything else; ask your vendor how to switch off remote access when it is not needed; and make sure every service provider with a login uses one unique to your business. It also says to make sure your vendors update your payment terminals, so leave card machines switched on and connected overnight and install any update the screen offers.
If your till is a PC from a local reseller rather than a tablet, look for the remote-support program it left running (TeamViewer, AnyDesk, Splashtop and similar). Ask the reseller to set it to ask on screen before every connection, to use their own named login with a sign-in code, and to remove any always-on access. Add the reseller to the contractor table.
A self-service kiosk is a till you did not set up. Ask its supplier three questions in writing: can it be reached from the internet, has the password it came with been changed, and is it still getting updates? The food shop's decision: two-step verification enforced for the team, two personal passcodes instead of one shared code, and the till tablet left on the main network. Time: 25 minutes.
The rest of the shop: screens, heating, locks, speakers, chargers
The smaller devices get one row each. The job is the same in every row: change the password, switch on the sign-in code if there is one, and move the device to the guest network.
| Device | What to change | The food shop's decision |
|---|---|---|
| TV in the window and digital signs | Samsung TV: set a PIN at Settings > All Settings > General & Privacy > Change PIN (sets made before 2025 shipped with 0000) and switch on Auto Update under Support > Software Update. LG commercial displays: change the installation-menu password from the factory code and switch on Lock Mode; the exact wording is in the model's installation manual. Switch off screen mirroring and anything else unused. | PIN changed, mirroring off, moved to the guest network |
| Thermostat and building controls | Nest: Google 2-Step Verification, staff added as Home members, leavers removed with "Remove this person". Honeywell Home and Resideo: Users > Invite New User, but everyone invited gets the same powers, including deleting other users, so invite sparingly. Building panel: ask the maintenance firm to confirm the installer login has been changed and the panel is not reachable from the internet. | The heating engineer's old invite removed |
| Smart locks, alarm panel and door entry | Ajax: App settings > Account protection > Two-Factor Authentication, then Sessions > "Terminate all other sessions"; installers reportedly get timed access of one, two, four or eight hours, granted by the hub owner or a PRO user already given full rights. August (a Yale company): the service always uses at least two factors; hand out guest keys that expire. Monitored alarms: engineer code changed from the factory one; remote access agreed in writing. | Written questions sent to the alarm company |
| Speaker and smart plugs | Alexa app: More > Settings > Account Management > Voice Purchasing > Purchase Controls > "No one"; Amazon Two-Step Verification under Login & security; recordings set to "Don't save" under Alexa Privacy. Google Nest speakers: Payments off in Assistant settings. Plugs: a unique password each and the guest network, never the till's. | Voice buying off; speaker and plugs moved |
| Car charger | Wallbox: tap "Charger update available" in the app; turn on OCPP (handing control to a charging network) under External Management only if you use one, with the certificate-based Security Profile Level 2. myenergi zappi: delay an update three times and the app stops working until it installs. ChargePoint confirms password changes with a one-time code. None of these described a sign-in code for ordinary logins, so use long unique passwords. | Not fitted |
| Temperature loggers and sensors | SensorPush: the gateway updates itself; sensors update from the app's "UPDATE FIRMWARE" button. Monnit: Users > 2FA tab for an authenticator app; gateway updates from the Gateways page. testo cloud: Configuration > Firmware updates > Activate, as its manual describes. One login per person, never the account owner's. | Alerts to two phones |
One warning on screens: in 2025 a national law-enforcement agency warned that millions of streaming boxes, projectors and similar gadgets, which security firms describe as cheap off-brand models, were infected before purchase or through apps from unofficial stores. Buy named brands for the window TV and the music, and keep them on the guest network.
What should I ask the refrigeration firm about its remote login?
The refrigeration firm, the alarm company, the camera installer, the till supplier, the IT contractor and any charging network may each hold a way into your building. Shops buy refrigerator controllers through contractors, so nobody assumes the security is theirs; one trade paper reportedly quoted a retail-group chief pointing out after the attacks that his stores are not the maker's customers at all but the refrigeration contractor's, and noted that who carries responsibility between maker, contractor and shop is a question the investigation has yet to settle. Send each of them these nine questions, and know the answer to expect. Questions 1–4 are the four in the message to the refrigeration firm above, sent to every contractor; expect, in order: no, or only through a private connection; yes, with named people; a version number and a date; a VPN. The other five:
- Can monitoring run one-way (the controller sends alarms out to you) with your login switched on only when we ask for a change? Expect: yes; some alarm systems reportedly let the owner grant an installer access for a set number of hours.
- What happens to that login when the person who holds it leaves? Expect: their access is removed the same day. One controller maker's own guide says to change passwords when anyone with access leaves and to delete the start-up administrator account.
- Will you alert us when a setpoint, defrost schedule or user account changes? A security firm recommended watching exactly these changes after the attacks. Expect: yes, by text or email.
- Can you send us a list of user accounts with their last login dates each month? Expect: yes.
- Do you hold a dated backup of our controller's settings, and will you send us a copy after each change? Expect: yes, with the date.
Fill in the answers as a table and keep it with the device list. The food shop's table, once the replies came back (illustrative):
| Party | What they reach | How they connect | When access is on | Who switches it on | Last reviewed |
|---|---|---|---|---|---|
| Refrigeration firm | Cold-room and cabinet controller | Their VPN | On request only | Shop manager | Week one |
| Alarm company | Alarm panel | Installer's app; engineer code changed | Service visits, agreed in writing | Owner | Week one |
| Camera installer | Recorder | Own account, on site only | Removed between visits | Owner | Week one |
| Till provider | Till dashboard | Their own staff logins | Support calls | Till provider | Week one |
| IT contractor | Router and office laptop | Own admin login with two-step verification | Always, under the contract | Owner | Week one |
| Charging network | Nothing: no charger, no OCPP | None | Never | Nobody | Week one |
"On request only" means the refrigeration firm no longer watches your alarms overnight. Either accept that and rely on the independent logger, or keep a one-way link: the controller sends its alarms out by email or to the firm's monitoring address while nobody can log in from outside, and the firm's login is switched on only for a change you have asked for. Put the choice into the maintenance contract in writing so its response promise still stands.
The column most owners cannot fill at first is "how they connect", and it is the one that matters. For what refrigeration service platforms do with that connection day to day, see what AI adds to commercial refrigeration service software.
An assistant can help you read the replies against the maker's own advice. Paste both in:
Below are two things: (1) the security page for our [maker] refrigeration
controller, pasted in full, and (2) our refrigeration contractor's email
reply about remote access.
Turn them into six plain-words questions I should put back to the
contractor, each with the answer I should expect if they are doing it
properly. Quote the maker's page where it supports a question. Mark
anything the contractor's reply does not answer. No jargon; if you must
use a technical term, explain it in brackets.
[paste the maker's page]
[paste the contractor's reply]In a sample run (illustrative), the draft was useful but needed four fixes. It invented a question about a "firewall certification" that neither document mentions. It used "VPN" without explaining it. It accepted the contractor's phrase "secure cloud portal" as an answer. And it missed the most important question of all: "Is the 4G modem yours, and what is its public address?" Strike the invented question, add the missing one, and send the list.
The modem with an aerial and the login nobody closed
The food shop's photo walk (still the illustration) caught this one. Behind the cold room was a small box with an aerial that nobody in the shop could name; the contractor confirmed it was their 4G modem, and the controller's web page had been reachable through it for three years. When the owner read the controller's user list for the first time, it showed Supervisor, the owner and "tech01", last used two years earlier. The modem's page showed a port forward set up so an engineer could get in from his phone, and that engineer had left the firm. The fix: the account deleted, the forward removed, and access moved to the contractor's VPN, switched on only on request. It cost an hour of the contractor's time.
How can I tell if someone has already been into the refrigerator controller?
Most owners find out from warm stock, but the controller and the makers' apps usually show signs first. Ask the contractor to read these out with you, or read them yourself on the controller's screen:
- A set temperature, defrost length or alarm limit that nobody on your side or the contractor's changed. In one reported 2026 case the attackers stretched a one-hour defrost to eight hours, which held the alarms back.
- A user account nobody can name, like the food shop's "tech01".
- A login in the controller's log at 3 a.m., or from an address neither you nor the contractor recognises.
- The controller's or the recorder's login page showing under your public address on Shodan.
- Fing, or the router's client list, showing a device that is not on your device list.
- A maker's app listing a phone or computer you do not own among its signed-in devices.
One rule overrides the readings. The joint government advisory mentioned in the ten-minute check says a device that was reachable from the internet and still on its factory password should be treated as already visited: it goes through the morning plan below even if every temperature looks normal.
What do I do if my refrigerator has been hacked? The 50-degree plan
Print this, fill in the phone numbers, and pin it in the plant room:
- Check the real temperature with a probe thermometer or a logger that does not depend on the controller, as one national cyber agency advised after the attacks.
- Cut the outside link only. The safest way is to switch the contractor's modem off at the plug: it carries nothing but the outside link. If the controller plugs into your own router instead, pull the one network cable that runs from the controller to the router (on a Danfoss system manager that is the port marked WAN or host network, the one that leads out towards the internet, not the second port that runs to the pack controller, the box that runs the compressors). Never touch the wiring to the cabinets, the pack (the compressor unit) or the sensors, and never cut the controller's power: it keeps running the cabinets on its own settings without the outside link, which is only how the contractor reaches it. If you cannot tell the cables apart, phone the refrigeration firm first and let them talk you through it. Then ask them to confirm the cabinets are running under local control. Do not change setpoints yourself.
- Call the refrigeration firm on [number] and say "suspected settings change": ask them to check setpoints, the defrost schedule, alarm limits and the user list.
- Photograph the screens and the stock, note the times, and keep a written record before anything is thrown away; in 2026 one affected chain had bailiffs (court officers) formally record its stores' losses, and a lawyer's advice reported by a trade paper was to inventory the destroyed products, notify the insurer and file a police report.
- Decide on the stock using your food-safety plan's temperature and time limits.
- Do not factory-reset and reconnect as before (the controller section explains why). The contractor reconfigures, updates, changes passwords and reconnects only through the private link.
- The same day, review the login lists on the cameras, alarm and till, and change their passwords.
- Ask the contractor for the controller's access logs; one national cyber agency suggested reviewing the last 90 days.
- Report it to the police on [number], tell your insurer on [number] within the policy's notice period, and check every other device on the list the same morning.
Week one at the food shop: hours, cost and what changed
The illustrative food shop's week, in doing order and at evening pace:
| Day | Job | Time | Cost |
|---|---|---|---|
| 1 | Kitchen smart refrigerator: old account out, two-step verification on, software updated | 20 min | $0 |
| 1 | Four-question message and a call to the refrigeration firm | 15 min | $0 now; the contractor's hour later, $150–$300 as an illustrative rate (ask for the quote) |
| 2 | Photo walk and the AI draft of the device list, checked against labels | 45 min | $0 |
| 2 | Outside check and Fing scan | 20 min | $0 ($49 Shodan Membership optional) |
| 3 | Router before and after, guest network on | 40 min | $0 |
| 3 | Move seven devices to the guest network | 60 min | $0 |
| 4 | Cameras and recorder, including the open port | 45 min | $0 |
| 4 | Doorbell and printer | 20 min | $0 |
| 5 | Till and card reader | 25 min | $0 |
| 5 | TV, thermostat, alarm questions, speaker and plugs | 60 min | $0 |
| 6 | Contractor access review and written answers | 30 min | $0 |
| 7 | Fit a SensorPush G1 gateway and four HT1 sensors (cold room and three cabinets) | 45 min | $319.75 |
| 7 | The six tests below | 20 min | $0 |
| 7 | Print the 50-degree plan and brief staff | 20 min | $0 |
| Total | about 7.75 hours | $470–$620 |
If the provider's router cannot isolate guests, add a UniFi Express 7 from $199 and the cash total rises to about $820 at most; a gateway plus an access point (a Cloud Gateway Ultra and a U7 Lite, $228) takes it to about $850, and the Firewalla Orange to about $1,020. A password manager is optional on top: Bitwarden Teams for six people is $24 a month billed annually, or $0 with the browser's own manager. The real unknowns are the contractors' rates, so ask for quotes before day one.
What changed by day seven: nothing in the shop is reachable from outside except through the makers' apps (the doorbell, thermostat and kitchen refrigerator, each behind its own login and the sign-in code where the maker offers one) and the contractor's VPN; every factory login is gone; both Wi-Fi passwords are new; two-step verification is on every account that offers it (seven in this shop); there is an alarm the controller cannot silence; one stale installer account is closed; and customers and the kitchen refrigerator are off the till's network.
The same plan across a 12-branch grocer with an IT contractor
Scale changes the order, not the steps. Take an illustrative 12-branch grocer whose IT contractor looks after laptops and email, while nobody looks after the refrigerators. The plan:
- One device register for all branches (about 240 lines), with the contractors' modems listed first because they are the doors nobody owns.
- The IT contractor's scope letter extended to every device with a cable or Wi-Fi, including those other trades fitted.
- A standard kit per branch, such as a UniFi Express 7 from $199 per branch, or a gateway plus access points where the branch is large, giving the same three lanes everywhere: tills, office, devices.
- The refrigeration firm's access through one private connection per branch, with named accounts, view-only for monitoring and changes by written request.
- A replacement budget for the two branches on unsupported controllers, because older units need physical changes and a software update alone is not enough.
- Independent loggers in every branch alerting the duty manager, plus alerts on setpoint, defrost, alarm and user changes.
- A pilot in three branches, then the rest. The $49 Shodan Membership monitors 16 addresses, so all 12 branches fit if each has a fixed public address (ask the provider; many small-business lines change address unless you pay for a fixed one, and monitoring a changing address means monitoring a stranger).
- Quarterly checks owned by one named person per branch. Expect four to six weeks, not one.
One chain's only affected store in 2026 was its last one still on an older controller model. Replace the stragglers first, and monitor independently everywhere.
Six tests that prove it worked, and when to run them again
- From a phone on the guest network, try to open the printer's page, the router's own settings page and, if the controller plugs into your router, the controller's page. None should load. A controller on the contractor's modem is not on your network at all: read its user list on its own screen, or from the contractor's monthly export.
- The outside check shows nothing under the shop's address, and the contractor has confirmed in writing how the controller connects.
- Sign in to each maker's app on a phone it has never seen: it should ask for a code, and its user list should show only current people.
- The router's page shows remote management, UPnP and WPS off and automatic updates on.
- Open the router's own client list (many routers show main and guest devices on separate tabs) and check it against the device list, line by line. Use Fing only on the main Wi-Fi to spot strangers there: a correct guest barrier hides the guest-side devices from it, which is the point.
- Warm a logger sensor in your hand and check the alert reaches both phones.
Every quarter, repeat all six, read the controller's log for logins at odd hours, ask the contractor again about the software version and support status, and remove anyone who has left.
Who can help me secure the refrigerator, cameras and tills in my shop?
Everything above can be done by an owner with a spare evening a day for a week. Some businesses are better off with help. I (Sagnik Bhattacharya) offer a one-to-one consultation on securing the refrigerator, cold room, cameras, tills and every other connected device in a business, booked through the contact page on this site. It suits an owner or manager with no IT person; one whose IT contractor looks after the laptops and email but not the refrigerators, cameras and tills; a business with devices across several sites; and anyone who has just found a device reachable from the internet, or a controller the maker no longer supports.
Outside help matters here for plain reasons. The settings are spread across a dozen maker apps and menus. A wrong change can switch off a safety function: a defrost schedule, an alarm limit, the alarm panel's line to the monitoring centre. The contractor who installed a device is rarely the one checking its security. And an owner does this once, while a consultant does it every week.
On the call we walk through your device list together and settle the network layout for your premises as they are, guest network or VLANs. We go through the settings to change on each device group in the makers' own menu names, decide which contractor and vendor logins to close and how to give the refrigeration firm a secure way back in, and run the outside exposure check together. You finish with a written plan your team can run without me, including the 50-degree morning page. I work with the owner directly, with no agency and no sales team; it is the same one-to-one AI implementation consultation I run for putting AI into a business, applied to the devices that AI tools and smart equipment run on. If that would help, book a 1:1 call with me.
Questions owners ask about hacked refrigerators and smart devices
Can a smart refrigerator be hacked?
Yes, if it is connected to the internet or your Wi-Fi. In 2015 researchers showed one smart refrigerator could leak its owner's email login, and in 2026 attackers warmed supermarket refrigerators by changing their controllers' settings over the internet. The realistic targets are the account behind a smart refrigerator and the controller box behind a display refrigerator, so change the password it came with, switch on updates and the extra sign-in code (two-step verification), keep it off the open internet and put it on its own Wi-Fi network.
Should I disconnect my smart refrigerator from the internet?
For a staff-room smart refrigerator, yes if nobody uses its online features: switch the Wi-Fi off and it still keeps food cold. If you do use them, keep it on the guest network with updates on. A display-refrigerator or cold-room controller should come off the open internet now and be reachable only through the maintenance company's private connection, after you have checked the maintenance contract and the insurance wording about that link.
How do I know if my refrigerator or another device has been hacked?
Look for set temperatures (setpoints), defrost schedules or alarm limits that nobody changed; logins at odd hours in the device's log; user accounts you did not create; the device's login page showing under your public address on a search engine for internet-connected devices such as Shodan; and devices not on your list. One joint government advisory says an exposed device still on its factory password should be assumed compromised, and a national cyber agency added after the 2026 attacks that a factory reset alone is not enough.
Do I need a separate Wi-Fi network for smart devices in my shop?
Yes. The minimum is the router's guest network with the 'allow guests to access my local network' box unticked, which keeps the refrigerator, cameras, screens and plugs away from the tills. A router that can create VLANs (separate lanes devices cannot cross) suits a larger shop or several sites. The payment-card industry's small-merchant guide says to put the payment system on another network from customer Wi-Fi. Test it by trying to open a device's page from a phone on the guest network.
How often should I repeat the checks on my shop's smart devices?
Every quarter, and again after any contractor visit, a new device, a router or internet-provider change, a leaver who knew the Wi-Fi password, or a maker's end-of-support notice. Each run is the six tests: the guest-network barrier, the outside check, a code asked for on a new phone, the router's three switches, the client list against the device list and a warmed logger sensor, plus a read of the controller's log and a fresh support answer from the contractor.
Can I hire someone to secure the refrigerator and other devices in my shop?
Yes. Sagnik Bhattacharya offers a one-to-one consultation, booked through the contact page on this site, that walks through your device list, the network layout, the settings on each device group, which contractor logins to close, the outside exposure check and a written plan your team can run without him. It suits owners without an IT person, businesses with devices across several sites, and anyone who has just found a device reachable from the internet.
Further reads
- AI Security Checklist Before Connecting Tools to Email and Files — The checks to run before any AI tool touches your email and files.
- Convenience Store AI Cameras: Cost and the Privacy Checks First — Camera costs for a small shop and the privacy checks to run first.
- AI Footfall Cameras for a Retail Store: What They Count and Privacy — What footfall cameras count and the privacy questions they raise.
- SOC 2 and ISO 27001 Explained: Checking an AI Vendor's Security — How to read a supplier's security certificates before you sign.
- How to Set Up Company AI Accounts Instead of Personal Logins — Move staff off personal logins onto accounts the business controls.
- Questions to Ask an AI Vendor Before You Sign Anything — The questions to put to any technology supplier before signing.
- Does Your Business Insurance Cover AI Mistakes? — Whether your business policy pays out when technology goes wrong.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: makers' help pages, manuals and store pages for Samsung, LG, Danfoss, Copeland, Carel, Hikvision, Dahua, Axis, Ring, Google Nest, Reolink, HP, Brother, Epson, Canon, TP-Link, Netgear, ASUS, eero, Square, Clover, Toast, SumUp, PayPal Point of Sale (formerly Zettle), Ajax, August, Amazon, Honeywell Home and Resideo, Wallbox, myenergi, ChargePoint, SensorPush, Monnit, testo, UniFi, Firewalla, Omada, Shodan, Censys, GRC ShieldsUP, Fing, Bitwarden and 1Password; the payment-card industry's Guide to Safe Payments for small merchants; the Cyber Resilience Act text and the Cyber Trust Mark programme pages; national cyber-agency alerts and joint advisories; and press and security-firm reports on the October and November 2026 refrigeration attacks. All checked 5 November 2026.