Q. Can smart home devices be hacked, and how do you secure them?

In October the news from France sounded like a tech thriller: hackers pushed supermarket fridges in about 700 stores up to 50°C (122°F) overnight. That French supermarket fridge hack hit commercial cooling systems, not anyone’s kitchen. Still, plenty of homes now have a smart fridge, a Wi-Fi camera or a video doorbell. So can smart home devices be hacked?

Yes, they can, but that is no reason to panic. Many of the best-known IoT hacking cases started with a device that still had its factory default password or had missed its updates. Put the other way round, changing passwords and installing updates removes much of the risk.

What counts as a smart home device?

The Internet of Things (IoT) simply means everyday objects connected to the internet. With sensors and a network chip inside, they send and receive data without anyone sitting at a computer. A Wi-Fi camera you check from your phone, an air conditioner you switch on from an app, a smart speaker, a video doorbell, a smart fridge and the router they connect through are all IoT devices.

Each of these gadgets has a small computer inside. The built-in software that runs it is called firmware, and like any software, it can have flaws that need fixing.

Why do smart home devices get hacked?

The reasons are surprisingly ordinary. First, many devices come with a factory default password, and every unit of the same product often shares it: something like “admin” or “12345”. Lists of these defaults circulate online, so they protect almost nothing.

Second, updates get skipped. Manufacturers fix flaws through firmware updates, and a device that never installs them keeps known holes open. In the French case, the equipment maker said the affected units were running outdated firmware.

Third, connected devices are probed all the time. An investigation by the UK consumer group Which?, quoted by the British government, found that a home full of smart devices could face more than 12,000 hacking attacks in a single week. Add the habit of setting a gadget up once and forgetting it, and many devices run for years on their day-one settings.

What was the Mirai botnet?

Mirai showed how big IoT hacking can get. It was malware that spread in 2016 through home routers, network cameras and digital video recorders, turning them into a botnet: a crowd of hijacked devices that follow an attacker’s orders. According to the US Cybersecurity and Infrastructure Security Agency (CISA), Mirai worked from a short list of just 62 common default usernames and passwords. That was enough to capture hundreds of thousands of devices.

The hijacked devices were used for DDoS attacks, which flood a website with traffic until it stops working. In September 2016 the blog of security journalist Brian Krebs was hit with more than 620 gigabits per second. In October, a Mirai-powered attack on Dyn, a company that runs part of the internet’s address book (DNS), made sites such as Twitter and Netflix hard to reach for hours.

The three young Americans who created Mirai pleaded guilty in 2017, but its source code had been posted online back in September 2016, and copycat versions kept appearing. Mirai proved that the camera in your home can be a victim and a weapon at the same time.

What happened in the South Korean wallpad hack?

Many South Korean apartments have a wallpad, a home-network panel on the living-room wall. It answers the door intercom and controls lights and heating, and many models have a camera for video calls.

In late 2021, preview images that appeared to show people inside Korean apartments turned up on a dark-web site. In December 2022, police arrested a man in his thirties described as a cybersecurity expert. According to South Korea’s National Police Agency, he broke into the wallpads of more than 400,000 households in 638 apartment complexes between August and November 2021, and police found evidence that he had tried to sell the footage.

The case showed that a device nobody thinks of as a computer, built into the wall and left alone for years, can still be a way into the home.

How do you secure smart home devices?

US and UK advice lines up closely: the Federal Trade Commission (FTC) and the UK’s National Cyber Security Centre (NCSC) both say to replace default passwords, turn on two-step verification where offered, install updates and switch off remote access or features you do not use. The NCSC suggests a password made of three random words.

Risk	Why it matters	What to do
Default password left in place	Often shared by every unit of a product	Change it on day one to a long, unique one
Old firmware	Known flaws stay open	Turn on auto-updates; replace unsupported devices
Remote access left on	Reachable devices get probed constantly	Switch it off unless you need it
Unused cameras and features	An extra way in	Turn them off; cover idle lenses
Neglected router	Every device connects through it	Change its admin password and network name
Selling or recycling a device	Videos and account links may remain	Factory reset it first

When you buy, check how long the maker promises security updates. Since 29 April 2024, the UK has banned guessable default passwords such as “admin” or “12345” on smart devices sold there, and makers must say how long updates will last. The government called it a world first. If you bring home a new gadget, change its default password the same day. If you think a device has been taken over, reset it using the maker’s instructions and set a new password before reconnecting it.

In short

Smart home devices look like appliances, but inside they are small computers on the internet, so yes, they can be hacked. Many known cases began with a default password or a skipped update, so start by checking both on the devices in your home today.