alt Hacker NewsSupermarket freezers across Europe hit by second suspected cyber-attack
Comments
Bless those hackers for firing a warning shot over our freezers, that we may take heed and secure our neonatal care units, stoplights, and air traffic controllers.
I'm extrapolating a bit here based on Reddit hearsay, but I think this may have to do with rural stores having essentially consumer-grade internet routers connected to the mobile broadband network.
Much of the coverage in Swedish media drives the point that only 4G-uplinked stores have been hit so far. I think that's unfortunate, because really it wouldn't have differed if these stores were connected by 5G.
I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router. In Scandinavia you can bypass CG-NAT on mobile connections by setting a particular APN, so my guess is that these control systems were simply findable on Shodan.
This also explains why this wasn't discovered after the recent French breach. Supposedly all the stores with "proper" uplinks were in compliance, and no one had thought of a way in for those non-compliant stores, because they "weren't even connected, so how would an attacker get in?"
Back in 1995 this was so improbable it was one of the purported negative effects of the "Good Times" virus which was a parody of the virus warning e-mails that were being forwarded around at the time. Computers still can't give you Dutch elm disease, fortunately.
> It will recalibrate your refrigerator's coolness setting so all your ice cream goes melty.
Also hit a few smaller business in The Netherlands: https://nltimes.nl/2026/11/02/fridges-freezers-17-dutch-busi...
With the following interesting quote from the supplier of the system:
After that attack, Danfoss advised its Dutch clients on October 13 to disconnect their systems from the internet and ensure they only reconnect via a secure network. “Most stores took action at that time, but a small number did not,” the spokesperson said. “They are now the ones suffering the consequences.” The spokesperson added that the systems hit last night were not on a secure network and were still using default passwords. The attack could have been prevented if measures had been taken, he said.
Discussion from 3 weeks ago on the refrigerator "hacks" in the french supermarkets:
https://news.ycombinator.com/item?id=50055304 (~1000 comments)
Why isn't the brand of cooler or cooler-controller being named?
Was it a password break or an open admin console or SNMP or what?
Reminds me of the AC at a large multinational Indian company I used to work for - the only way to adjust the temperature or airflow was by calling a service desk operated from, you guessed it, India. Bit of a nuisance when it's -10 degrees outside, while the support people are working in excess of 30; they just didn't understand why anyone would want anything higher than 16, nor were they willing to let it sit at a reasonable temperature.
Meanwhile, you have stores like CircleK that, at least in most of Europe, operate a large fleet of externally connected monitors that keep track of temperatures, but staff themselves adjust the fridges and freezers. All you get by breaching those would be a bunch of temperature readings. Great in a pinch if you're looking to buy an industrial fridge or freezer, not so much for anything else.
There was an interview with an angry store manager, he's mad at the attackers, but I didn't hear the media ask him why they didn't improve security after the French attacks. Only now do they appear to want to start a review of their monitoring system.
https://www.svt.se/nyheter/lokalt/skane/icas-kylar-och-frysa...
Pain is a good teacher, for a better or worse.
Too often it takes repeated failures to clock in as a persistent problem at the necessary levels in an org.
If neither law nor insurance nor a CEO require it, it often doesn't get done.
How did every supermarket chain around the world not jump at this and investigate?
So anyone that has lived in large Windows corporate IT land, a lot of decisions get made by people that aren't technical. Come to think of it, it's probably why a large majority of "hacks" happen to Windows machines; a highly technical team with a vulnerable OS will probably have the right security layers in place to mitigate this.
Maybe we should stop connecting things to the Internet that don't need to be?
This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time. Or to take the freezers offline if an update isn't available.
I now read some interviews with local chains in Sweden and Finland, and they were still just investigating what to do at this point.
Ok, so now all the fridges have been remotely optimised: unplug them fromm the internet. I very much doubt the inability to ping a remote server will immediately cause them to shut down. Operate at last-known-good until mitigations are available.
This is what happens when you over-optimize and over-automate. You should just be able to plug those freezers into power and turn a knob to set the temperature. There is no reason for them to ever have an internet connection.
Similar thing in Estonia: https://news.err.ee/1610183296/hackers-raised-freezer-temper...
I've fantasized a long time about a clearer separation of technology from life, since it's been depicted in some ways I appreciated in fiction. But at this point, I'd just take a set of laws around what types of items should ever have any sort of networking.
Ireland too: https://news.ycombinator.com/item?id=50335252
After hearing of such attacks, I always wonder what is the possible benefit anyone gets from acts like these
If you definitely need to connect them to the internet, make them read only?
I was talking yesterday to my AI imaginary friend about creating an MCP for one of my apps, and the first thing she told me was to make everything read only. No matter how many security layers you have in place, passwords, auth libs, whatever, it will be leaked/hacked so you better be prepared for minimum damage
Monitor your freezers temperature? yes, but never allow their thermostat to be set over the internet. I hope the lesson is learned. Applies to all appliances
I wonder if the companies affected this time missed the news about the French attack a few weeks back?
> Danfoss said it had identified security flaws last year and had “long recommended” customers install updates.
This is a cyber-attack made possible through severe negligence on the victims’ part. It’s like a home burglary where the victim left the door wide open for months without ever checking on their home.
Therefore, the news should be about that negligence. That's the interesting part.
Thats interesting something similar happened at military grocery stores in the US a couple months ago
Every time I read news like this I am wondering what an average household has hanging on the internet, totally vulnerable.
I would love to read about how insurance premiums are driving technology changes, in general. How insurance companies are tabulating risk from AI hacking. Risk of noncompliance probably brought the store operators to networked fridges, how is the network risk evaluated in general?
Insurance risk and premiums might be the main drag on the AI future.
What's the incentive here? Just some tech anarchism? I would have figured that they at least demand bitcoin to reverse it or something. I know, people will blame the Russians, but seems not super productive for them to do such mundane sabotage on such non-critical systems.
This is actually good news. Accountability is everything when it comes to food supply. Forcing people to witness spoiled food is the slap people need to feel else they will never take action. The prolific insecure code that is keeping you from eating today will always be fixed.
I wonder if this might point to some efficiency loss coming from AI. Let me explain.
Say in 2015 they installed those smart refrigerators, they could go from 20 people monitoring temperatures to 1. That was some profits being made by those companies, and they got to enjoy those benefits until now.
With AI finding exploits for so many things people wouldn’t spend time looking, we might need to go back to dumb fridges out of security concerns.
Now extrapolate to many other industries, the economic gain from AI might be hampered.
It's a really a bad thing ... It's not the first time that these kinds of attack hit the European markets. So I ask to myself why in earth managers don't learn from the bad experiences of other countries/people.
Hope all the fridges in hospital keeping medicines at exact temperatures are better protected these days then they used to be.. The can't exactly be air-gapped wither as they need monitoring for compliance etc.
You'd have thought all supermarkets would have audited their refrigeration vendors, or at the very least firewalled vulnerable controllers... Oh well...
Not everything needs to be connected to the internet.
They must have learned from the last incident and made the password slightly harder to guess.
Will the insurance pay out on this? It would be negligent to have this exposed to the internet - was it?
It happened in France on 12 October: https://www.bbc.com/news/articles/crq5nzxv9q4yo
> a deliberate attempt to disrupt our food supply chain and undermine consumers
I would bet that if it will ever be resolved, it will turn out to be just some bored kids[] who read the recent report from France and had access to Shodan and a competent AI model.
[] I'm using the term "kids" loosely here, not refering to a certain age group but to a certain mindset, similar to the original term "hacker"
Holy fuck don't connect your freezer to the internet. And if you do, have it be read-only, not change settings. Did we learn nothing from Battlestar Galactica?
i know some of us are thinking "if you consistently fail to ensure your ability to make high-severity security patches reach critical internet-exposed systems on time you lose your ability to operate the business and probably get jail time"
but what about the deranged (and very prediction market–brained) version of this idea: the government develops ransomware, in a manner functionally similar to towing cars or confiscating illegal items, and uses it against companies in proportion to their revenue and obviously puts the money towards improving the ransomware
"the r in rsi stands for…"
i'm not sure it's something i want to see, but i don't know if it's impossible for it to actually come to pass or merely unlikely
(of course, cross-government versions of this are much more likely to come about but not as ransomware)
This is exactly the kind of thing we've all been warning about ...
(... in hacker forums)
Why the fuck does a freezer need access to the Internet in the first place?
Considering how Europe has embraced huawei and I saw a lot of their gear in consumer use when I was there, I’d be interested in seeing the Ben diagram of huawei gear and impacted stores
Instead of pointing the finger at supermarkets we should point it at ourselves. Why the hell is anything computer related still so difficult? Even in this thread I see varying advice like airgap, VLAN, or VPN. Well which is it?!
We keep blaming store owners for not being IT wizards.
My fridge beeps loudly when something is wrong, and it has no connectivity to any network. Exactly how a fridge is supposed to be, why are we reinventing fridges…
Why the previous attack wasn't a strong enough signal to make every European retailer unplug their freezers from the internet is a mystery to me.
Hack my freezers once, shame on you, Hack my freezers twice shame on me.
I mean in US these TV dinners, all these frozen foods are just way of life. Could it be that some good European citizens are angry with frozen foods and it is just their way of telling "EAT FRESH FOOD".
Unpopular opinion: Accessing a public service with public default credentials is not a cyber attack but a consequence of severe misconfiguration. This is on the supermarkets, not on the attackers.
As I mentioned in the thread regarding the previous attacks, I worked in a closely related field back in 2008-2009.
One thing I see repeatedly brought up here in this discussion is "Why can't we just set the refrigerator temperature with a knob and walk away?"
The problem is that these refrigerator cases are not as simple as your refrigerator at home. As a simple example, many systems allow you have control over the deadband: the exact low temperature at which the compressor turns off and the high temperature at which the compressor turns back on. You also have control over defrost cycles, compressor pressure and many other things (I worked with this a long while ago, and I don't remember all the details).
Take a look at some of these manuals, for example: https://www.hillphoenix.com/resource/installation-manuals-2/... As far as I can tell, those manuals just cover the refrigerator cases, and not the outside compressors and heat exchangers, which are another layer to deal with.
This is not something that a non-expert supermarket employee would be able to handle well. The purpose of all these settings is optimize around energy usage, maintenance costs, customer experience, etc. Even if you only save $500/store/year, you can see that it really adds up over a chain of 1000 stores.
That's why this equipment is remotely accessible: it's not like your fridge at home and requires a lot more knowledge to get the most out of it. Of course, that does not excuse poor security implementations.