Why does a washing machine need Wi Fi?

The article argues it does not. Remote start offers little value because you must load the machine by hand, yet the feature requires firmware, an app, backend infrastructure and APIs that all need securing.

What happened to the French supermarket fridges?

Overnight on 11 to 12 October 2026, attackers forced refrigeration units into extended defrost cycles, pushing temperatures up to around 50u00b0C. Les Mousquetaires said about 150 of its stores were held at that temperature for six hours.

How did the attackers get in?

They used legitimate defrost functions on controllers whose management interfaces were reachable from the internet. Danfoss said the affected systems ran outdated firmware or were at end of support life.

Does connectivity make a product better?

Not automatically. The article says the industry has confused connectivity with innovation, and notes a Bluetooth toothbrush whose battery seems to last about half as long as the old one.

05 Nov 2026 Cyber Macbooks

Why Does My Washing Machine Need Wi-Fi? IoT Security Lessons from the Supermarket Fridge Hacks

Q: How many systems were exposed?

Forescout found 12,976 exposed refrigeration management service observations across 6,017 IP addresses in 99 countries and territories, some running firmware with known vulnerabilities.

By Andrew Baker · Group CIO, Capitec Bank · 5 November 2026

1. The Meeting I Would Love to Have Attended

I really would like to understand the conversation that led here. Somebody sat in a product meeting, looked at a perfectly functional washing machine, and concluded that the missing ingredient was an internet connection. I imagine it went something like this: the washing part works, dirty clothes go in and clean clothes come out, so what is next? Someone suggests connecting it to the cloud, someone else asks why, and the answer comes back that people will be able to start their washing machines from their phones.

Think about what that actually means in practice. I have to physically walk to the machine, pick up the dirty clothes, open the door, load them, add detergent and close the door. Having done every single one of those things while standing directly in front of the machine, the great technological breakthrough on offer is that I can now take out my phone, find an app, wait for it to sync, and press Start, instead of pressing the button that is literally in front of me. And yet somebody paid for this. Somebody built the firmware, somebody built the app, somebody is running the backend and maintaining the APIs, and somebody, somewhere, is supposed to be keeping all of it secure, so that I can avoid pressing a button.

I can think of people who might genuinely use it: someone with limited mobility, someone who wants the machine to run when electricity is cheapest, or someone who loads it in the morning and wants it finished when they get home. Those are real use cases. My point is not that the feature has zero value; it is that the value has to be weighed honestly against fifteen years of software, security and support obligations that come bundled with it, and I doubt that calculation was ever done.

2. Meanwhile, in Europe, the Fridges Were Cooking the Food

This would all be harmless silliness if it were not for what has happened across Europe over the last month. Overnight on 11 to 12 October 2026, attackers got into the refrigeration management systems of hundreds of French supermarkets and forced the units into extended defrost cycles, and retailers reported temperatures inside some fridges and freezers reaching around 50°C. Les Mousquetaires, which owns Intermarché, said roughly 150 of its stores had units held at that level for six hours. Food was thrown away across the country, initial estimates put the losses in the millions of euros, and several stores reported fires. Forescout later put the number of affected French supermarkets at more than 700, and the French cybersecurity agency confirmed that controllers from Danfoss, Copeland and Dixell were all involved.

What the attackers did once inside is clear: they abused legitimate, built in functions, specifically the defrost settings, to turn the equipment against its own purpose, without needing destructive malware. How they got in is less settled. ANSSI identified a vulnerability in Danfoss supplied software, Danfoss said the affected systems were running outdated firmware or had reached the end of their supported life, and the management interfaces were reachable from the internet. Whether the entry point was a specific exploit, weak or default credentials, or stolen contractor logins has not been conclusively established in public reporting. Either way, every plausible route runs through an inadequately protected remote access path, and for many of the affected installations that meant a management interface reachable directly from the internet. These were commercial refrigeration management systems, not household appliances, and nothing here shows that washing machines are vulnerable in the same way. It is also a different, and worse, architecture from my washing machine, which connects outward to its manufacturer’s cloud rather than waiting for strangers to log in. Both create risk, but an exposed management interface hands the attacker the controls directly, while an outbound connection moves the risk to the manufacturer’s cloud, its accounts and its update pipeline. Neither is free, and only one of them should ever be acceptable for equipment that can start a fire.

And it did not stay in France. On 2 November, a second wave hit supermarket refrigeration in seven more European countries, Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, with Delhaize, SuperValu, Coop and ICA among the chains affected. When Forescout went looking for the wider exposure, they found 12,976 internet exposed refrigeration management service observations across 6,017 IP addresses in 99 countries and territories, some of them running firmware with known vulnerabilities. That figure counts exposed services rather than individual fridges, but it tells you the problem is not a French one. We have reached the point where keeping milk cold requires a cybersecurity strategy, and the second wave suggests that the warning in the first one was not heeded quickly enough.

3. Every Connection Is a Lifetime Obligation

As someone who spends most of his time thinking about architecture and security, this is the part that genuinely bothers me. Every connected device carries complexity that does not go away after the sale: firmware that needs patching, cloud services, certificates and tokens that expire, third party libraries with their own vulnerabilities, and an app that must keep working across years of phone updates. My previous washing machines lasted many years, and I never once wondered whether the manufacturer still supported the operating system.

A washing machine that lasts fifteen years is good engineering. A washing machine that lasts fifteen years but only receives security updates for five is an architectural liability. Manufacturers are selling software liabilities with lifetimes that exceed their commercial commitment to supporting them, and the supermarket controllers are exactly this story: hardware that still worked perfectly well, running software that had been left behind. Unlike laptops and phones, these devices are forgotten the moment they are installed, and nobody wakes up on a Sunday morning wondering whether the dishwasher needs a firmware patch.

That raises a fair question about accountability: should anyone be allowed to sell an internet connected appliance without committing to how long it will be kept secure? Regulators have started to answer it. The UK’s product security regime, in force since April 2024, bans universal default passwords on consumer connected devices and requires manufacturers to state the minimum period for which they will provide security updates. The EU’s Cyber Resilience Act goes further: once its main obligations apply in December 2027, manufacturers must set a support period that reflects how long the product is expected to be used, with five years as the general minimum, not a ceiling. Both are moving in the right direction by recognising that security support should match a product’s expected life rather than an arbitrary maintenance window. The real test will be whether manufacturers actually support connected appliances for as long as customers reasonably expect to use them.

4. We Have Confused Connectivity with Innovation

Somewhere along the way the technology industry developed a belief that connecting something to the internet automatically makes it better, so a washing machine with Wi-Fi becomes a smart washing machine, a fridge with an app becomes a smart fridge, and a toothbrush with Bluetooth becomes a smart toothbrush. Yes, toothbrushes: Oral-B sells models that talk to a smartphone app to coach your brushing, and my own new toothbrush now has Bluetooth too. I will never, ever pair it with anything. What I have noticed is that its battery lasts roughly half as long as my old one did. I cannot prove the radio is to blame, but I find it hard to believe that adding a wireless chip and a pairing stack made the battery last longer, and battery life was the one thing I actually wanted from a new toothbrush. I would happily trade every connected feature on it for a toothbrush that simply lasts.

Nobody I know asked for any of this. I have never met a person who complained that their toothbrush was insufficiently networked, or who wished their washing machine had an attack surface. We have somehow convinced ourselves that a product becomes smarter when it becomes dependent on more things that can fail. The question that rarely gets asked is which genuine problem in the customer’s life the connection actually solves.

5. Follow the Money

If customers did not ask for it, then who benefits? A connected appliance gives the manufacturer something a disconnected one never could: an ongoing relationship after the sale. It can produce usage data, keep the brand on your phone’s home screen, prompt you to reorder consumables, and open the door to subscriptions and paid features later. None of that is evidence of any particular manufacturer’s intentions, and some of it may be harmless, but it does explain why the connectivity keeps appearing whether or not anyone wants it. The uncomfortable question is whether the internet connection exists to improve my washing machine, or to improve the manufacturer’s relationship with my wallet. When the commercial incentive belongs to the manufacturer and the security risk belongs to the customer, you should not be surprised by the results.

6. A Short Hall of Shame

The supermarket attacks feel new, but the pattern is old. Here are three cases of controls that should never have been reachable from the internet, or were reachable in the laziest way possible.

The Bremanger dam, Norway, April 2025. Attackers got into the web accessible control panel for a valve at the Risevatnet dam and opened it fully, releasing around 500 litres a second for four hours before anyone noticed. The owner suspected a weak password, and Norway later blamed pro Russian hackers. The reservoir was low, so nothing flooded, but someone had a dam’s controls through a web page.

Aliquippa, Pennsylvania, November 2023. An Iranian government affiliated group took over the controller at a water booster station, forcing the utility onto manual operation. According to CISA, the device was exposed to the internet and still on its factory default password, which for that model was “1111”, and the same group hit similar devices across several US states.

Lviv, Ukraine, January 2024. Malware sent commands straight to a municipal energy company’s heating controllers, cutting heat to more than 600 apartment buildings for almost two days in below freezing weather. The attackers had entered months earlier through an internet exposed router, and a flat network let them walk all the way to the controllers.

Most of these did not need a sophisticated exploit. They needed a device that should never have been exposed, or a password that should never have been allowed, or a network flat enough to walk across. These were not failures of advanced defence; they were failures of basic architecture.

7. Six of the Strangest Things We Have Put Online

If the hall of shame is the serious end of the spectrum, this is the absurd end. Some of these were real incidents and some were researchers proving a point before criminals got there, and I have marked which is which, but every one of them is a product that somebody, somewhere, signed off.

A casino fish tank (real). Attackers got into a North American casino through an internet connected thermometer in a lobby aquarium, moved across the network, and sent out around 10 GB of data, reportedly including the high roller database. The casino’s security budget presumably did not have a line item for fish.
Children’s teddy bears (real). CloudPets toys let parents and children swap voice messages through the cloud. The company left its database open on the internet with no password, exposing more than 800,000 accounts and links to over two million voice recordings, and the data was repeatedly held to ransom.
A kettle (research). In 2015 Pen Test Partners showed that the iKettle could be knocked off a home network, tricked into joining an attacker’s network, and persuaded with two commands to hand over the owner’s Wi-Fi password in plain text. The Android app left the kettle on its default password. A kettle, leaking the keys to your house network.
A luxury toilet (research). In 2013 researchers found that Satis smart toilets used the same hard coded Bluetooth PIN, “0000”, on every unit, so anyone in range with the app could flush it or operate the bidet. I am choosing to see this as validation of my decision never to pair my toothbrush.
Pacemakers (research, then a recall). In 2017 the FDA announced a firmware update, formally treated as a recall, for about 465,000 radio enabled St. Jude Medical pacemakers in the US to fix cybersecurity vulnerabilities. There were no known reports of patient harm, but patients had to visit a clinic to have the heart device patched.
A Jeep at 70 mph (research). In 2015 Charlie Miller and Chris Valasek took control of a Jeep Cherokee on a highway through its cellular connected infotainment system, with a journalist at the wheel. Fiat Chrysler recalled 1.4 million vehicles.

None of these devices needed to be reachable by a stranger to do its job. A fish tank needs to keep fish warm, a teddy bear needs to be hugged, a toilet needs to flush when you ask it to, and a pacemaker needs to keep a heart beating. Every one of these failures was bought, in effect, as a feature.

8. Just Because You Can Does Not Mean You Should

I am not against connected devices. A solar inverter that lets me monitor generation and battery health is useful. A security camera I can check remotely is useful, provided it is properly secured. A medical monitor that alerts someone when a patient is in distress can be lifesaving, and a supermarket refrigeration system that warns an engineer when temperatures start to rise is enormously valuable.

The difference is between using connectivity to solve a real problem and connecting something because the technology exists. Even when remote access is justified, public internet exposure is a separate decision that has to justify itself, and it usually cannot. Private access through a secure gateway, multi factor authentication, local control, restricted permissions and proper network segmentation deliver almost all of the benefit without leaving the controls available to the entire planet, which is exactly what Forescout and CERT-FR recommended after the fact. Above all, the device should keep doing its primary job when the internet disappears, and every product meeting should ask one question out loud: what happens if we do not connect this thing at all? If the honest answer is that nothing important is lost, stop there, and if nobody in the room can state the benefit of the connection in a single sentence, the device probably should not be connected in the first place.

9. Innovation Is Also Knowing When to Stop

The technology industry has become remarkably good at adding capabilities and surprisingly bad at asking whether they should exist. We celebrate feature counts, integrations, apps and cloud connectivity, but we very rarely celebrate the engineer who stands up and says that none of it is needed. We probably should, because the absence of a feature can itself be evidence of good engineering. Sometimes the most intelligent design decision is to leave something disconnected, sometimes the best user experience is a physical button, and sometimes the most secure cloud architecture is not having a cloud architecture at all.

As for my new washing machine, I am going to keep doing something rather revolutionary. I will put my clothes in it, add the detergent, and press Start on the machine itself, because I bought a washing machine and not another endpoint to manage. The smartest washing machine might well be the one that is too stupid to be hacked. And if the industry genuinely believes that my toothbrush, my washing machine and my fridge all need to be on the internet, then I am left with the same question I started with: what the hell are you thinking?