Have you ever considered a refrigerator or a thermometer a threat to your business’s security? Probably not. Yet both can become entry points for hackers. Connected devices that seem harmless can expose a company’s network to unexpected risks. The weakest link in a company’s security is not always its computers, servers, or users; it could be something as ordinary as a fish tank thermometer or a refrigerator. This article examines two incidents, one involving a casino and another affecting French supermarkets in October 2026, to show how seemingly harmless equipment can create security risks far beyond its intended purpose.
These incidents highlight the security challenges posed by the Internet of Things (IoT), a term used to describe physical devices connected to the internet that collect, exchange or act on data. From temperature sensors and refrigerators to industrial machinery and building management systems, IoT devices allow businesses to automate tasks and monitor operations remotely. However, each connected device can also create a potential entry point for cybercriminals, particularly when security is overlooked. As Companies connect more equipment to their networks, protecting these devices becomes an increasingly important part of cybersecurity.
When a Fish Tank becomes a security threat
In July 2017, cybersecurity company Darktrace reported that hackers accessed a North American casino’s network through an internet-connected fish tank thermometer. Sensors linked to a computer monitored the aquarium’s temperature, feeding and cleanliness.
According to Darktrace, attackers used the system to access the casino’s wider network and transfer data to an external device in Finland. Around 10 gigabytes of data were reportedly sent out. The casino never publicly disclosed its identity or the exact nature of the stolen information.
The incident showed that a device does not need to store sensitive information to pose a security risk. What matters is what an attacker can access through it. Although the aquarium had nothing to do with the casino’s core business, its network connection gave attackers a potential route into other systems.
This is why Companies need to look beyond their computers and servers. Devices used for building management, monitoring or other specialised tasks should not automatically have access to business-critical systems. Keeping these devices on separate internet access networks can limit the damage if one is compromised.
The French Supermarkets incident
In October 2026, cyberattacks reportedly targeted refrigeration systems at hundreds of French supermarkets, including stores operated by Intermarché, Coopérative U, Carrefour and Monoprix.
Attackers remotely manipulated refrigeration settings, causing temperatures in some units to rise as high as 50°C. The disruption reportedly led to spoiled food and fires. Intermarché said around 150 stores had been affected, with some refrigeration units remaining at elevated temperatures for several hours.
Early reports pointed to weaknesses in refrigeration controllers, including outdated firmware and insufficient protection. French cybersecurity authorities advised affected businesses to take protective measures, such as disconnecting exposed systems from the internet where appropriate and updating vulnerable equipment. At the time of reporting, investigations were ongoing, and no attackers had publicly claimed responsibility.
Unlike the casino incident, which reportedly involved data being transferred outside the Company, the supermarket attacks disrupted a physical process. The refrigeration systems were manipulated to do the opposite of what they were designed for, putting food supplies at risk and leaving businesses to deal with waste, disruption and financial losses.
The incident also raises questions about responsibility. When equipment is managed by external maintenance providers (third parties), businesses may not know exactly how it connects to the internet, who can access it or whether its software is up to date. Without clear third-party monitoring, security gaps can go unnoticed. Responsibility for securing the equipment should be clearly defined. If a controller is managed through a provider’s portal that is accessible over the internet, the provider is responsible for implementing appropriate security measures to protect it. If the controller is managed within the Company’s own network, the Company is responsible for securing it.
Security must extend beyond computers and users.
The two incidents had different consequences, but the underlying problem was similar: connected equipment was not just equipment. It was also part of the Company’s wider digital network.
Internet connectivity itself is not the problem. Remote monitoring and automation offer real benefits. The risk comes when devices are connected without adequate security controls or ongoing maintenance.
Companies can reduce these risks by separating specialised equipment from the Company network and connecting it to an internet-only network, so it cannot communicate with the rest of the infrastructure. Other measures include replacing default passwords, restricting access and applying security updates. Companies should also identify devices that no longer receive manufacturer support and replace or upgrade them. Conduct regular vulnerability assessments and penetration testing on all Company networks, and carry out due diligence on suppliers before allowing their devices to be installed on their network. They should also conduct quarterly or bi-annual risk assessments, based on the Company’s operations, to identify emerging threats and potential vulnerabilities, and establish clear security responsibilities with third-party providers.
Ultimately, a device’s security risk depends not only on what it does, but also on what it can access. A fish tank and a supermarket refrigerator may seem unlikely targets, yet either can become a way into systems that matter far more.
