The Weekly Breach Breakdown Podcast: Cold Calls & Deepfakes - How AI Automates Cyberattacks - S7E35

Refrigerators and CEOs don’t usually belong in the same sentence — especially in cybersecurity. However, right now, both are being weaponized in the exact same trend: the terrifying ease of artificial intelligence-driven cyberattacks. Welcome to the Identity Theft Resource Center's “ Weekly Breach Breakdown ” for Nov. 13, 2026.

I'm Alex Achten, vice president of media relations for the ITRC. Thanks to SentiLink for supporting the ITRC and this podcast . Each week, we review the latest events and trends in data security and privacy. This week, we are looking at two separate incidents that reflect the increasing use of AI-driven cyberattacks and how easy they are to pull off.

First up: European grocery stores (and some of their U.S. operations) are dealing with a bizarre — and costly — wave of physical cyber disruptions. Over the last several weeks , attackers remotely hijacked commercial refrigeration and freezer systems across hundreds of supermarkets in France, Belgium and several neighboring countries. Instead of deploying ransomware or stealing customer payment card data, the threat actors went after the physical controllers that regulate temperature.

They forced the units into continuous, prolonged defrost cycles — pushing temperatures up to 50 degrees Celsius, or 122 degrees Fahrenheit. That not only spoiled millions of dollars in frozen and fresh food overnight, but in several stores, the extreme heat triggered thermal runaway and caused actual physical fires. What makes these attacks so alarming isn’t advanced, nation-state malware. The attackers didn't need to write custom code.

They weaponized standard, built-in maintenance features on internet-exposed controllers that lacked basic access controls. With automated reconnaissance tools and AI-assisted network scanners, finding exposed industrial systems connected directly to the web is faster and cheaper than ever. Once an attacker identifies the controller's public IP address, they can remotely manipulate operational technology with a few keystrokes — turning everyday hardware into a direct physical threat to business operations and the food supply chain. That collapse in technical effort isn't limited to hardware.

While automated tools are making physical operational targets easier to sabotage, AI is doing the exact same thing to social engineering — this time, putting executive identities in the crosshairs. That brings us to our second story. A new study from security awareness firm KnowBe4 highlights just how vulnerable organizations are to AI-generated voice scams — and where the biggest risk actually lies. Surveying 500 office workers in Singapore, the research revealed a startling trend: compliance with a cloned CEO voice rises with seniority.

Thirty-five percent of senior managers said they would likely comply with instructions from an AI-cloned voice of their chief executive before ever verifying if the call was real. That is more than double the compliance rate of clerical workers, which sat at 16%. Senior managers were the most confident in their ability to spot a deepfake, with 78% claiming they could tell the difference. That gap between confidence and reality is exactly what cybercriminals exploit.

Creating a believable voice clone no longer requires studio equipment or hours of high-grade audio. A threat actor only needs a few seconds of an executive speaking on a public earnings call, a media appearance or a podcast to generate a synthetic voice capable of issuing urgent instructions. When you combine that technology with corporate culture, the danger multiplies. Half of all survey respondents admitted they feel uncomfortable questioning an executive's request, and 45% said they worry just as much about delaying the boss as they do about causing a security breach.

Yet, only 26% of workers said they have received any training on AI-generated impersonation schemes. Whether an attacker is tampering with supermarket cooling systems or cloning an executive’s voice on an urgent phone call, both stories point to the same reality: AI and automated tooling have eliminated the hardest, most labor-intensive parts of a cyberattack, leading to more AI-driven cyberattacks. The takeaway isn’t that the underlying vulnerabilities are brand new — it’s that AI has lowered the floor. Attacks that once demanded advanced resources and deep technical skills are now fast, cheap and easily executed by everyday scammers.

What should you do about it? First, treat smart hardware like any other computer. If you have internet-connected appliances, thermostats or security cameras at home or work, change the default passwords , keep their software updated and put them on a separate guest Wi-Fi network so a compromised device doesn’t open your entire home or business. Second, don’t trust audio alone.

If you get an urgent request for money, credentials or sensitive data — even if it sounds exactly like your boss, a bank rep or a family member — pause and hang up. Call them back on a known, trusted number to verify the request before taking action. As always, the ITRC is here to assist you. If you want to know more about how to protect your business or personal information , AI-driven cyberattacks or believe you are the victim of identity theft, fraud or a scam, you can speak with an expert advisor on the phone, via text message, chat live on the web or exchange emails during our normal business hours Monday through Friday (6 a.m.

to 5 p.m. Pacific time). Just visit idtheftcenter.org to get started. Thanks again to SentiLink for their support of the ITRC and this podcast .

Please hit the like button for this episode and subscribe wherever you listen to your podcasts. Next week, we will have an episode of our sister podcast, the “ Fraudian Slip ,” with Scott Anchin of the Independent Community Bankers of America. He will join ITRC CEO Eva Velasquez and President James E. Lee to look into their crystal ball and make their predictions for 2027.

We will return in three weeks with our final episode of the “ Weekly Breach Breakdown ” for 2026. I’m Alex Achten. Until then, thanks for listening.