During China's National Day holiday, the cloud servers operated by Woda Technology for its smart power strips used in fish tanks were compromised by malicious hackers. The breach caused remote disconnections and unexpected power outages across affected user devices, killing batches of ornamental fish including koi and arowana that owners had raised for two to three years.
Timeline of the Incident
On September 30, 2026, around 20:30, the Woda Technology smart power strip server system suffered a malicious intrusion. This led to abnormal remote disconnections and power loss for multiple users. Fish tank equipment such as heating rods, oxygen pumps, and circulation pumps, which depended on the smart strip for continuous operation, failed during the peak holiday period. Within hours, fish began dying and floating belly-up.
Initial suspicions pointed to product defects until Woda published an official notice stating the event resulted from a "malicious hacker network attack" rather than quality or operational issues. The company immediately blocked vulnerabilities, restored servers, filed a police report, retained attack logs for tracing, and transferred evidence to judicial authorities.
Technical Root Cause and Remediation
Woda announced four corrective measures: upgrading server firewalls, adding multi-layer cloud protections with offsite backup servers, optimizing local offline protection logic so devices maintain power even without cloud connectivity, and implementing 24-hour backend monitoring. The offline logic improvement addresses the core issue where cloud failure previously caused complete device paralysis.
The smart power strip functions as a relay connected to the public internet. Commands from a user's phone travel through the vendor cloud platform before reaching the device, creating a single point of failure. Attackers who compromise the cloud gain equivalent control over connected household appliances.
Broader IoT Security Implications
The attack may have been a test of vulnerabilities, validation of access, or recruitment of bots rather than direct extortion. Regardless of motive, it demonstrates how physical safety becomes dependent on potentially unpatched embedded systems maintained by smaller vendors.
Users are advised to conduct disconnection tests, isolate smart devices on guest networks or subnets, change default passwords, disable unnecessary remote ports, and add physical backups such as mechanical timers for critical equipment like fish tanks or medical devices.
