Updated | 3 million smart toothbrushes cause millions in damage due to DDoS attack

Update February 8, 2024: Following criticism of the authenticity of the information provided by Fortinet, the cybersecurity company has published a statement clarifying that the DDoS attack was merely a "hypothetical scenario" and that no attack had actually taken place in this form.

To clarify, the topic of toothbrushes being used for DDoS attacks was presented during an interview as an illustration of a given type of attack, and it is not based on research from Fortinet or FortiGuard Labs. It appears that due to translations the narrative on this topic has been stretched to the point where hypothetical and actual scenarios are blurred.

Original story:

While computers and smartphones are supplied with security patches almost every week, such updates for smart gadgets such as scales, washing machines or toothbrushes remain the exception rather than the rule.

As reported by Swiss German-language newspaper Aargauer Zeitung, the lack of security on smart toothbrushes has now resulted in millions of euros in damage after more than three million infected toothbrushes simultaneously accessed the website of a Swiss company, causing the servers to collapse and the website to be unavailable for four hours. The report cites data from cyber security company Fortinet, which subsequently wrote in a statement that any device connected to the internet is a potential target and can be misused for such attacks.

This applies in particular to smart home cameras, webcams and baby monitors, which can allow attackers to access sensitive data, but also to apparently less critical gadgets. For a minimum level of protection, users should, if possible, enable automatic updates for all internet-connected devices, provided the manufacturer provides patches at all.

Otherwise, the only other option is to either cut devices off from the internet completely via your own Wi-Fi router or at least keep an eye on upload and download rates: disproportionately large data transfers, especially outside the usual usage period, can be an indication that a device has been infected with malware, as recently shown in the case of a washing machine with around 3.6 GB of data transfers per day.