Hackers activate automatic defrosting in supermarket fridges across Europe

…and that’s a good thing, as this non critical incident will raise awareness for safety in more critical domains like power plants, medical devices… oh who am I kidding.

Eventually a digital act of terrorism or war will be enacted that will kill thousands or more.

Fridge attack! We live sci-fi indeed! %-)

Maybe, just maybe, fridges shouldn't be online. Cue immediate responses of: but don't you understand, management can now monitor it 24/7 and adjust in real time. To which I have about the same response:

Maybe they shouldn't.

I wonder if AI would have helped in this situation.

For example [request to defrost n fridges in y locations]->[agent cannot find any emails or business communications about this and last defrost report was only a short time ago, contacts z personnel]->defrost task moved to manual confirmation by a human.

I know many will roll their eyes and "tchh" at it but look at number of AI related topics on HN front page and think to yourself if you're tired of this tech not being used for real applications or not. This would be a real application.

"But it could be tricked" well...regular requests can apparently already be hacked, so...

Wait until they discover they’re all filled with butane as a refrigerant.

> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

I worry that this kind of thing is going to be a recurrent problem. A lot of people have pretty strong intuitions, or even an explicit moral position, that they should never have to upgrade a physical machine that's working fine. Is there a threshold of vulnerability that will overcome that, or are we just going to see a lot more hacking of random infrastructure from now onwards?

... Feels like deja vu. Didn't the US military just have this happen at its military exchanges... a month or two ago?

Yes, yes they did. https://www.militarytimes.com/news/your-military/2026/08/28/...

"ALL freezers went into defrost mode – ALL frozen food has spoiled".

How in the name of fuck was a fridge even designed to be able to heat itself to 50 degrees C?

Here's a fix:

if(temp > 5) return;

Please, let this be the stone that starts the avalanche of consumers rejecting smart apppliances.

My fucking fume hood on my stove has Bluetooth, because Samsung just can’t help themselves apparently.

TomsHardware hit? I'm getting spinning beachballs on this link

Of all the things to put on a network, this ranks as one of the dumbest, ever. You don't need control of the unit done over a network, just the data on whether it is working or not. Anything else is simply asking for someone else to come along and break your stuff.

To boot, refrigeration has been wholly automatic for decades. It literally runs itself. It doesn't need any network connectivity other than to say "I work" and "I'm broken" and that's it. Allowing control commands to be sent over the network is, yet again, just asking for trouble.

I feel no pity for them at all. If they're too stupid to secure their fridges (which seem to be accessible over the internet) than that's their deserved pain.

Interesting. The government has been suggesting war with Russia is coming. This would be a great initial move. Take out the European food supply network, then hit things like the grid and the internet.

It's funny because red storm rising is an old book at this point, but it's pretty accurately shown exactly how conflict with Russia plays out. Even down to Russia realising it is about to run out of diesel... causing it to invade Europe while it still can.

What genius decided to connect a fridge to the Internet? Make him pay the losses.

By the way similar thing might happen to geniuses buying Internet-connected cars.

Good. I’m not happy that this happened. That’s a large financial loss. I don’t like thinking about all the good, edible food thrown away instead of nourishing people. But the infosec thing that keeps me up at night is the utter lack of SCADA security. “Relax! This dam won’t collapse as long as no one guesses our public IP address!”

Lots of industrial controls haven’t been updated since they were deployed in the 90’s. “And why should they be? If it ain’t broken…” Well, because they’re freaking broken!

So I’m glad that this happened in a tangible, public way people can easily understand without it involving something much more drastic. If your family asks about this, explain that you’re glad no one blew up a gas pipeline… yet.

[dead]

from https://blog.claroty.com/team82/research/freeze-the-controll... :

> Our research uncovered a hidden "code-of-the-day" authentication mechanism that could be abused to bypass normal authentication

> Our analysis began by examining the internet exposure of these devices, where we identified thousands of publicly accessible management interfaces

> (shell injection vulnerability in management interface)

This is how we used to vibe-code before we had LLMs.

[dead]

Great. We already waste a ton of food, let’s destroy even more.

This is terrible. But, at the same time, why now? This seems like something you'd want to hold onto for use later as a nation state. And there's no money to be made here since you can't really ransom it. Was this just a petty attack to scare the public?

On the bright side I'm sure the manufacturer and others will have an increased security posture going forward.

Remind me again why I should buy an internet-connected refrigerator?

This is literally everything that's wrong with the modern tech industry in a nutshell:

> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

They sell fricken refrigerators for God's sake. Maybe I can understand planned obsolescence for a cell phone, but a fridge? And especially to grocery stores that operate on razor thin margins to begin with, the idea that they'll just dump their old working refrigerators because the manufacturer refused security updates is a guaranteed recipe for stuff like this.

Another good example why writing secure software matters in the age of connected devices.

Why is that even internet enabled?

If you want to defrost it presumably someone already needs to be physically present to unload the fridge?

Why is this even connected to the internet. If you want to monitor it remotely, you can set that independently from the actual controls.

> The software allows retailers to manage their cold units remotely.

Will they never learn?

[dead]

Why the fuck are those fridges even networked!?

[flagged]

[flagged]

[flagged]

[flagged]

[flagged]

Gilfoyle again?

There is so much needless connection to the internet nowadays; this is the end result of a decade of shoving IoT into everything.

Beyond some corporate manager seeing a dashboard that will cause them to say "oh neat" in a meeting once, there is zero reason to put a refrigerator's cooling system online. Or frankly any network for that matter. Is there really such a massive productivity increase from being able to remotely change the temperature when a human has to physically visit the machine to restock every day anyway?

These incidents will bring back the appeal for dumb appliances, hopefully.

Instead of climate change, let's call it "cyber change"...the rise of hacks of all kinds facilitated by AI