Fridges in French supermarkets hit by cyber attack
bbc.com134 points by cataflam 5 hours ago
134 points by cataflam 5 hours ago
Maybe, just maybe, fridges shouldn't be online. Cue immediate responses of: but don't you understand, management can now monitor it 24/7 and adjust in real time. To which I have about the same response:
Maybe they shouldn't.
I would maybe tone that down that sentiment a bit and limit the adjustement.
You actually do want to be able to monitor them remotely, like most industrial/commercial refrigeration, to detect failures faster and more reliably. They should still be at least secured with normal auth/autz in addition to perimeter security, though.
If I can know when a fridge failed within the hour (even at night) then I can also dispatch a technician same/next day more easily.
If what's needed is the ability to monitor them, then why are these things remote-controllable?!
Obviously read-only access to some sensor is not the same attack surface as having the ability to remotely shut-down the refrigeration.
Same reason website's are remote controllable. There's someone who's job it is, is to make sure the fridge is up and running, 24/7 and for the same reason that website operators/SREs don't live at each POP/DC, that fridge operator wants to remotely be able to flip some relays off and on to fix the problem without having to drive onsite, if possible. Additional, a single person/fewer people can then also be responsible for multiple/more sites.
That’s exactly right. There all all sorts of read-only architectures where the device can be monitored without every directly accessing it:
- The device’s control has a radio transmitter that emits its readings, but no receiver. Listen for those messages to monitor it but there’s not a physical path to reply to it.
- The device’s controller writes a database or message queue. Its code never reads from that source. Monitors listen to those messages.
And many, many similar methods with the same core concept: the item transmits its status but doesn’t have a method to receive replies. You just have to commit to using any one of those thousands of mechanisms.
The fridges are cheaper to make because they don't need a bunch of knobs and switches and temperature displays - just an app on employee phones.
Read-only access is mostly an illusion that itself can be hacked to gain control.
I have a read only temperature sensor in my old-school non-computerized refrigerator and freezer. Hack until the cows come home but it still can't turn off my freezer.
Air-gapping, network segregation, data diodes, etc. are all real things. It's possible to make a read-only refrigerator that is "unhackable". I have a temperature monitor in my refrigerator right now. Hack that monitor and it doesn't affect my refrigerator at all.
not in this case where a thermosensor can do nothing but monitor a temperature.
Yeah? We had an old Unix server that printed its logs in realtime to a dot matrix printer. How are you going to gain control of that?
Read-only is a strong control with lots of solid implementations.
Depending on the make and model, send a reverse feed code and then overwrite with block characters. You will know that something bad happened, but you won't know what.
There is value in nuance and debating whether the solution should be scaled down to say a store ( or only available on local vlan or something), but I think the value of discussing that is kinda diminishing, when, apparently, the controls for all stores can be done from the same hit.
But to address your specific point:
being able to monitor does not ( or at least should not ) automatically equal put it on the web
There are most likely IT governance problems: builders bought fridges, IT didn't provision sufficient access, installers put 3G keys instead of spending time getting the correct VPN/networking, and a few months later no one knows how this thing works, and IT is not mandated to find out that shops ever did that.
this definitely does not require a fridge be "online" and have the ability to be remotely programmed. At the very least have the monitoring and potentially I/O capabilities in a different device that can easily be removed from the system. Integrated smart fridges deserve to Suck it, Jin-yang!
This still shouldn't be online. They can be networked, if you need remote monitoring, but that's different from being online (at least in my definition).
Obviously it's a question of cost and convenience, and just dumping your appliance on the internet and make it phone home is going to be the cheaper option. If you want security those appliances goes on a separate network, which cannot reach the internet.
> This still shouldn't be online.
This line suggests the units themselves were targeted individually with a hack:
> Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.
But the problem with networked devices spread across tens of thousands of pretty much unguarded locations, surrounded by unvetted employees, but taking orders form a central location is that there is no such thing as "not online". They'll talk to the management server used to set up the nightly defrost schedules across the fleet. Even if they are in an isolated VLAN, it's always one step away from someone connecting a Pi to that network and off they go online. There's only so much zero-trust, NAC/802.1x and segmentation can do when some devices will be too old to support these and their network will be the entry point to the management server, then to the whole fleet.
I'm honestly very surprised that a couple of things things haven't happened yet: the central server for managing these fleets getting hacked and allowing access to the entire fleet, and/or the companies realizing that the only way to limit the reach of an attack is to physically not have the hardware needed to do remote control.
So this is how it was done 25 years ago: Only the used ports (ethernet jacks) on a network is activate, disconnecting a device and the port closes. That strictly speaking doesn't mean that there aren't way to get devices on the network, but it does make it a lot harder. You're absolutely correct about these networks being in hostile environments, but why then do we pretend that they are not? Fridges like these have never not been in a hostile environment, so why aren't basic security measures taken to secure the physical side of things?
In my world the central server can be hack in two ways, that is by a malicious operator or via some scheme like the US/Israeli attack on Irans uranium centrifuges. The central server also have no business being online, that to is on a closed network, running the whitelisted applications from the manufacturer.
This is how it was done in this [0] very nice 60 years old (I'm sad now) movie. [Spoiler alert] An alarm is triggered so many times the guards just disable it. Alert fatigue has worked the same forever. Nobody wants to check the thousands of such events that probably happen every day across thousands of locations.
As long a such a schedule is made to be conceived in one place and applied in another, even with human intervention on both sides, either one of the sides can be swindled. At this point with the barrier for entry into successful hacking being lower than ever, completely removing the hardware necessary to make remote changes is probably the only way to limit the blast radius.
Maybe allowing to send the schedule but requiring a local employee to operate a local hardware only control to apply it could work, but who has the money for this kind of complexity. Something like this on every freezer (device, really) in a fleet probably costs multiples of the money they lost with the spoiled food.
To be clear, they didn't monitor it 24/7, otherwise they would have noticed the fridges were grilling the pizzas.
Like the other poster mentioned, blanket statements like this ignore the incredibly smart people at major international corporations and their strategies.
I have a smart fridge and washer. I won't name names. But for several years they were never connected or online at all (unless they was compromised and I didn't know). I connected them and one of the first updates included in the washer was changing the default wash cycle from something like 110 minutes to 46 or something. I don't remember all the values if I'm honest.
There are executives who have spreadsheets and charts of how much water that saved per household over varying periods of time. How much it would save with greater adoption. And the unsaid message, or maybe they'll be explicit, of how many people are going to face tragic water supply issues in the future.
It's a powerful message, even if we know it's cyncical and calculated to push not just washers, but firmware security systems and institutions to govern those systems.
And yes, compromised systems can also be used to build zombie networks to push horrible content.
I feel horrible that this critically important surface issue of water supply is used to push other agendas. I honestly wish I could do other work not related to it.
<< ignore the incredibly smart people at major international corporations and their strategies.
Ignore may be a tad strong. I am merely asking for hardware that is subject to my control to be within my control. I think somewhere along the way executives got a little to comfortable saying 'they will buy what we give them'.
More to the point, maybe there is exactly too many smart people with agendas that don't seem to align well with my current needs vis-a-vis fridges:
I want something that keeps things cool with minimum of fuss and does not die upon update.
In short, that executive should be fired as they are not doing their job: they are actively undermining their own market.
>Ignore may be a tad strong. I am merely asking for hardware that is subject to my control to be within my control.
Which is how they got into this situation. These are industrial refrigeration systems subject to a huge list of variables (how many units, their sizes, and doors hooked up to a refrigeration circuit, open vs closed cases, ambient conditions, hours of store operation, what type of refrigerant, whether heat is going to a cooling tower or air heat exchanger). They use a ton of energy, and percent optimization leads to millions of dollars over a fleet. They are designed to let the user dial in every operating parameter, like defrost.
Compare this to my home fridge where all these parameters are fixed in the firmware because the hardware is 100% identical.
Industrial systems are necessarily different from mass-produced home appliances.
Agree. I don't want fridge company or anyone else to turn my fridge into residential proxy with its access sold to the highest bidder to build web scrapers.
Monitoring would be one thing, but there's almost no conceivable reason to allow setting the temperature or triggering a defrost cycle remotely. When was the last time you changed the temperature setting on your fridge or freezer? It's something you set once when you install it and then never touch again.
This kind of inspector gadget "smart tech" lunacy has infected basically all consumer products. It's got to stop.
> This kind of inspector gadget "smart tech" lunacy has infected basically all consumer products. It's got to stop.
Absolutely, and this is why I refuse to connect any home appliances to the Internet. I have a limited number of Zigbee devices, and they are managed through Home Assistant and can't access the Internet.
Yes, I have similar strategy. But in all cases I'd prefer to just buy analog appliances. There's no good reason to put a digital computer in a refrigerator. A bimetallic thermostat does the job just fine.
> When was the last time you changed the temperature setting on your fridge or freezer?
Then again when was the last time you opened your freezer hundreds of times during one day, letting humid air in and building ice at an accelerated rate? These units actively heat up the back of the freezer (evaporator plate) nightly to quickly melt the ice without warming up the food.
There is no reason to directly trigger it remotely but they probably work on a customizable schedule, to account for different store opening times, timezones, or freezer size and model. The hackers could target that schedule to make the defrost last longer.
You're right, a commercial freezer is a different beast than a household one. But what good does it really do anyone to be able to adjust that defrost schedule remotely? Surely the personnel on site are the ones best equipped to schedule the defrost cycles of their equipment?
Within a store certain freezers get more traffic than others, depending on how they're stocked, where they're located, etc, and therefore likely require more frequent defrosting. But that's something the store managers can figure out. It doesn't need to be managed remotely by some third party. So why did someone engineer that capability?
More features, generally, means more failure modes. More ways to exploit the system. Adding fringe features that aren't actually necessary (or desired) has become a strange industrial compulsion. It's very unhealthy and disordered behavior from an engineering standpoint--sacrificing reliability and simplicity for... what exactly? Some centralized control capability? But why?
To be clear I don't think the defrost schedule is the way the hackers enabled this or else every device would be affected. The older devices probably connect to the SaaS server in an insecure way and could be exploited en-masse.
> Surely the personnel on site are the ones best equipped to schedule the defrost cycles of their equipment?
The purpose of the automation is the same as always, to run at peak effectiveness and reduce human error. Most of the workers in this industry much like the fast food one, are low paid, low skill, receiving only basic training, with a high turnover rate, across tens of thousands of locations from major cities to somewhere in the sticks. Even a disgruntled employee can do a lot of damage that's only obvious too late. So this extra work is taken out of their hands. You should really see a lot of the machines the big fast food chains use, you'd be amazed.
This kind of decision was never left to the store manager. In the past they'd get a printout and probably fail to follow the instructions occasionally, which may or may not cause damage or increases operating costs across the entire fleet. Now it's done over the network like everything else, for better or worse.
They only managed to hack a small subset of older models that couldn't be patched which makes me think they've done a decent job at securing them so far. Hiring more people, implementing more security, or losing efficiency over tens of thousands of locations costs more than the spoiled food.
> Adding fringe features that aren't actually necessary (or desired) has become a strange industrial compulsion.
Here's the kicker, they are necessary and desired by the customer. I know you had a solid 5-10 minutes of though on the topic but for supermarket chains that's how they manage to operate cheaper, that's how they don't increase the cost of the food.
With the tools available today though, it's an uphill battle to keep thinks connected and secure.
> something the store managers can figure out
That's like saying the store manager should manage the store website and networks instead of the chain's IT department.
No grocery store manager is going to be a licensed refrigeration technician. Ask them if they know about basic refrigeration concepts like superheat and subcooling, high side and low side pressures, compressor oils...
Further, a grocery store wants to optimize efficiency down to the percent, because that will save tens of millions of dollars over the fleet, and CO2 emissions. A store manager hardly has the capability.
Monitor yes
Adjust: possibly, withing a range
Shutting down: Big no no
well they weren't shut down. just adjusted. and the adjustment range apparently went up all the way to +50 centigrade...
It's not a maybe. They simply shouldn't. The level of idiocy of not only management but also those who implemented the "security" protecting those online fridges cannot be understated: we're talking about real dumbfucktards.
I see such idiots daily, in all venues of life: the world is simply really full of dumbfucks.
It's simply how things are and we shouldn't be afraid of pointing it out.
This is pretty interesting as the Danfoss vulnerability was suspected to be related to a similar situation that occurred across US military bases in late August 2026.
https://signalandsilence.substack.com/p/i-think-someone-hack...
Could this be the same group? Or someone inspired by reading that article? Or just entirely unrelated?
immediately thought of this article as well. really interesting. I could imagine someone using options/futures or other obscure financial instruments to make some money off this. hard to think of other motivations
Perhaps they’re motivated by Europe’s support for Ukraine and the recent data center attacks in Russia?
So they mess with 5% of one chain's freezers? idk maybe i'm being naive seems so silly
I think Russia is doing random stuff of the kind, my understanding is it’s just about sawing general chaos, not doing a strong action that would be discussed at a diplomatic level.
Really though? this feels cartoonishly evil, like the kind of thing a children's cartoon villain would do. It doesn't have any meaningful impact
Interestingly, a major Dutch supermarket was also hit by a yet-undescribed cyberattack, prompting them to basically shut down every IT system. So not a hack of a control system, sounds more like an ordinary ransomware attack... but still tantalizing that two EU countries have their food supplies targeted the same day... the day of a big NATO "russia we dont mess around" conference, too.
Looks like that specific vulnerability was found this summer, disclosed in coordination with the vendor and at least some models were patched [0] (unclear if all models were), but from early reports:
- they either didn't warn their customers this was a critical security patch, - many of these fridges/freezers were directly accessible on the internet with their own 3G/4F SIM cards without further protection!
Crazy stuff
[0] https://www.claroty.com/team82/research/freeze-the-controlle...
That is a shocking read! check_code_of_day WTAF! How did Danfoss not go around to all customers and hand-install a patch for this.
Aug 28, 2026 https://signalandsilence.substack.com/p/i-think-someone-hack... I Think The Military Commissary’s Freezers Were Hacked
> Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.
I feel like this is kind of holding the supermarket hostage and saying, “Sure your freezer is working fine, but if you refuse to buy new freezers from us prepare to get hacked.”
Sure you can argue that the supermarket should have just taken the old freezers offline. But you can also argue that the manufacturer could have supplied software updates but didn’t in order to force sales of newer models.
1 data point of Yep. I went to my local Monoprix to grab a few things during lunch break. For some reason they seemed to have suffered a fridge incident, good for me I didn't need anything from those aisles. I did wonder if it was just a recent problem or if a more sneaky malfunction had silently semi-spoiled some of the products I brought back days before, until it just blew over.
Supermarkets in the Netherlands were also hit. Seems like a Russian linked attack.
So, those fridges are in the supermarkets, right? Where people work, who have to empty a fridge before it can be remotely defrosted. Why can't those people just press a defrost button? What is the point of doing defrosting remotely when you cannot do it without the onsite support?
>Where people work, who have to empty a fridge before it can be remotely defrosted.
You don't empty a fridge with built-in defrost. Your home fridge defrosts itself every 12-24 hours and you don't have to do anything.
Normally, the temperature recovers in ~1 hour after a defrost. The attack is apparently chaining manual defrost commands one after another so that the interior gets way too hot.
Could it be that it defrosts only by raising the temperature for a few hours just a bit to get the same effect and they food stays there?
That's way the non-smart walk-in coolers work; every 12 hours they turn off the fans and heat the cooling element for about 15 minutes to melt any ice that's built up on it.
Ice anywhere else is treated as a separate problem and turning the cooler off to fix it is not typically an available option.
Something different came to mind as I read this article - there has been recent chatter regarding impending Food security issues - it was even talked about by India's foreign minister recently:
https://www.thehindu.com/news/national/eam-jaishankar-warns-...
I wonder if this attack is some kind of early warning about capabilities of disruptive forces.
Watch Dogs was ahead of its time. How long before one of these hacker groups claim the DedSec name as their own?
Good. I’m not happy that this happened. That’s a large financial loss. I don’t like thinking about all the good, edible food thrown away instead of nourishing people. But the infosec thing that keeps me up at night is the utter lack of SCADA security. “Relax! This dam won’t collapse as long as no one guesses our public IP address!”
Lots of industrial controls haven’t been updated since they were deployed in the 90’s. “And why should they be? If it ain’t broken…” Well, because they’re freaking broken!
So I’m glad that this happened in a tangible, public way people can easily understand without it involving something much more drastic. If your family asks about this, explain that you’re glad no one blew up a gas pipeline… yet.
There is certainly a need to raise awareness of the danger of connected/online devices. If something is connected to the public Internet then it can be attacked. If something has built-in wireless connectivity then it can be attacked. Unfortunately it really is as simple as that. Safeguards are needed accordingly.
Connected vehicles are the example that terrifies me the most. There have been numerous examples of lax security in this area already and a fleet of rogue cars or delivery trucks could obviously cause huge amounts of damage, injury, and loss of life.
There's a legacy of openness in car tech and software that was never designed with robust security and isolation of critical components in mind. I've heard that this has started to change more recently and that's reassuring if true. But this still feels like an area with far too little regulation or oversight given the past choices of vehicle manufacturers and far too much rush to connect everything up remotely even for minor convenience reasons.
In some cases there also now seems to be legally mandated connectivity for things like automated emergency calls after an accident. This should at least have a genuine benefit in the unfortunate situation that it's needed - but until vehicle security looks more like Fort Knox than a sandcastle it might still prove to be a bad choice in the end.
> Connected vehicles are the example that terrifies me the most.
Fortunately, there is a straightforward solution. Find the cellular modem fuse and pull it. You now have a modern, but fully offline car. Security aside, connected cars are absolutely awful for your privacy.
Unfortunately that straightforward solution might also compromise other aspects of the vehicle and/or might also be illegal if it disables a mandatory safety system.
The "straightforward" solution is to tell vehicle manufacturers that they aren't allowed to sell vehicles with connectivity unless they also have proper security and privacy protections in place. If no-one can give them money for it then they won't do it.
That's a workaround, not a solution. And a partial one at that since it only affects your own vehicle; you'll still be in danger from other people's connected vehicles.
These are fridges in supermarkets, not home fridges. I think a supermarket capable of administering many fridges can put their big boy pants on and handle the potential downsides of controllability.
This thing is addressing problems that don't exist. It's solutionism at its worst. We are dumbing down machines that are inherently superior.
It really, really irks me that in one of the articles about this, it mentions the manufacturer pointing to "outdated firmware", and even comments here demeaning the store for not "securing" their __refrigerators__. Read that twice, and think how many times this silliness could apply to far too many objects in our lives.
Very few things should be networked, or at the very least, not with any sort of control. I can't even blame the average person anymore for not being as aware about technology, unless there's some sort of aggression or dismissive responses when they're informed of the risks or potential risks. Software developers at this point may very well end up being as despised as lawyers or bankers, for not broadly enough condemning this sort of technological creep, but for being that guy smugly saying something about firmware updates ... on a refrigerator.
> The software allows retailers to manage their cold units remotely.
Will they never learn?
To not control any industrial processes remotely? I hope you realize that requiring that would make solar and wind farms completely non-viable, among many, many other things.
Leased lines, MPLS, custom routing setups, hell just a VPN that fails closed. There are so many options for doing this, all more secure that just slapping a device online behind whatever router the cheapest ISP gave you.
The problem is that many of these setups are put behind essentially consumer connections, but with a better support contract or simply fitted with a 5G modem and a SIM card from the cell provider with the cheapest plan.
Building a WAN isn't magic, but it does require working with (competent) ISPs and paying the higher cost.
Remote control does not mean "has a public IP address."
Yes you might need to be able to centrally monitor and manage things but that should be happening on a private network.
A public IP address may be a necessity, but with a properly configured VPN it is irrelevant whether anyone knows the public IP addresses.
Surely, there must be a way that does not force the devices onto world wide web..
Seems like 95% of devices could be managed with a hardware filter that only allows through a handful of very rudimentary signals (more like Morse code than a full digital transmission), and then of course a properly designed on-device API that defines those signals and doesn't allow you to trigger a defrost remotely, when that should only ever be done with somebody physically present for example.
Morse code is a fully digital transmission.
How exactly would a more obscure (or even “analog”) encoding help? This seems orthogonal to reducing surface complexity and remotely executable command subsets.
I'm interested to know how many "legacy" controllers no longer patched by the manufacturer are operating solar and wind farms today.
If it's a lot, maybe the manufacturers should be compelled to provide security patches if remote control is required to operate their products. For the sake of national security, of course.
If they didn't do it that way, some bad things would happen: sometimes a fridge would fail and the food in that fridge would spoil.
* Fridges are welcome to send a panic message.
* Fridges are read-only through their remote interface.
Both of these can be true if you must connect them to the internet.
You're saying remote control stops a fridge failing? Or a fail spoiling the food?
I doubt the fridge has a remote-controlled robot arm to unload itself.
That's funny, last I checked my fridge keeps food reliably cold with no internet connection, and most supermarkets have people around all the time to notice such a failure, a plan around such a failure, and expect to have such a failure periodically since fridges break down anyway.
Meanwhile you can use analog gauges if you need perfect max temperature monitoring.
That's what always pisses me off about this. Someone brought up "Hey, if we connect this to the internet to enable that feature, someone will start hacking fridges and hurting our customers, and I don't think the stupid page with a temperature graph on it is worth that tradeoff", and some ass told them to get over it and implement it.
Raymond Chen used to write about feature development at Microsoft, specifically how every single new feature idea started from a negative position, since it requires support and testing and engineering and thought, and has future repercussions, so it's often not a good idea to just add box checking features.
Microsoft believed this in the 90s. For things like UI functionality. That's the effort and thought and restraint required to have a consistent UI, for things to be thought out.
Somehow, between then and now, the industry threw all that thought away, and now everything has 400 totally unused, half implemented, utterly broken features.
Why are we here? "Move fast and break things" just breaks everything eventually. Someone, somewhere, eventually has to fix stuff.
Of all the things to put on a network, this ranks as one of the dumbest, ever. You don't need control of the unit done over a network, just the data on whether it is working or not. Anything else is simply asking for someone else to come along and break your stuff.
To boot, refrigeration has been wholly automatic for decades. It literally runs itself. It doesn't need any network connectivity other than to say "I work" and "I'm broken" and that's it. Allowing control commands to be sent over the network is, yet again, just asking for trouble.
[dead]
no more french fries!!!
> While they may be known across the world as ‘French fries’, there’s nothing French about them. The name ‘friet’ comes from patates frites, Belgian-French for ‘fried potatoes’. One possible explanation for the association could have been formed in the First World War, when American soldiers were introduced to ‘fried potatoes’ in Belgium, but thought they were in France because that was the language spoken in that region. Whether you call them Flemish or Belgian, our delicious fries are made from bintje potatoes per tradition, and are the tastiest you’ll find anywhere on the planet.
Source: https://www.visitflanders.com/en/discover-flanders/culinary-...
Honestly, if you ever come to Cyprus and get good fries from the potatoes here, freshly cut and fried…
The Belgian fries have no leg to stand on, nothing. Sorry. Just my opinion :) but I’ve been a life long fries lover from Germany - and these beat out all other fries I had so far in Europe at least by a wide margin :P
I know it wasn’t your article but I wanted to spread this important knowledge to the world!!